It seems that you're using an outdated browser. Some things may not work as they should (or don't work at all).
We suggest you upgrade newer and better browser like: Chrome, Firefox, Internet Explorer or Opera

×
Tomorrow, on April 1st, a mysterious program named Conficker is set to activate. Everyone's convinced it's a dangerous worm. What do you guys think of this scare, and how do you think we should protect ourselves for whatever tomorrow brings? Should we disconnect completely from the internet for a day, run all our powerful anti-virus programs, or just say "to hell with it" and run around naked on the net?
Personally I think it could be a April's fools joke... but then I'm beefing up my antivirus programs just in case.
I just ran a virus check tonight, and didn't find anything, so I'm guessing I'll be ok.
Also, if it is real and you do have it, disconnecting from the internet for a day won't work. It'll just activate the next time you get on. Just go to download.com and download AVG or Avira or some other free virus check software, and you should be fine.
avatar
anoffday: I just ran a virus check tonight, and didn't find anything, so I'm guessing I'll be ok.
Also, if it is real and you do have it, disconnecting from the internet for a day won't work. It'll just activate the next time you get on. Just go to download.com and download AVG or Avira or some other free virus check software, and you should be fine.

Just checked myself, and it looks like I'm A.O.K. By the way, everyone should try things like visiting antivirus websites and visiting websites that are against conficker. If the site doesn't load, chances are you have conficker.
It's estimated that the varies Conficker variaties have infected at least 3.4 million computers.
There are several variants, but 3 main ones: A, B and C.
A used a bug in Windows and tries to contact 250 sites a day.
B targets networks and spreads through file shares and USB sticks.
C, which is the one that becomes active April 1, tries to contact 50,000 websites a day.
C is also the one that's spread the least, so it shouldn't be too much of a problem.
It's quite an ingenius piece of software.
It doesn't install other versions on infected machines.
It's protected against take overs by using a public and private key system for updates.
It checks the country it's in based upon IP and language settings of the operating system.
It also checks the bandwith and the capabilities of the machine it infected to see what it can do.
Every worm also counts the number of machines it infected.
Botnets are money generators nowadays.
They're used for spamming, DoS attacks, hack attempts, etc.
A botnet itself is worth money as well and there's a market for it.
Creating such a piece of software to create such a large botnet which has the potential to create millions for the owner doesn't sound like an April's fool joke to me.
Note that with up-to-date operating system and security software you shouldn't have a problem.
The sites which are checked by the trojan every day are generated with some kind of algorithm. That algoritm is known and the sites are blocked or prevented from being created by domain registrars.
The C variant probably excists due to 1 or a few sites not being blocked in an earlier stage of the development of this worm.
avatar
anoffday: I just ran a virus check tonight, and didn't find anything, so I'm guessing I'll be ok.
Also, if it is real and you do have it, disconnecting from the internet for a day won't work. It'll just activate the next time you get on. Just go to download.com and download AVG or Avira or some other free virus check software, and you should be fine.
avatar
TheCheese33: Just checked myself, and it looks like I'm A.O.K. By the way, everyone should try things like visiting antivirus websites and visiting websites that are against conficker. If the site doesn't load, chances are you have conficker.

No need to check antivirus websites.
Simply check if your antivirus program can receive updates.
Post edited March 31, 2009 by HertogJan
The scariest part of the worm lies in the checking of the websites. Orders are given on randomly-created websites, which the worm checks for and follows. It's like a commander watching the battlefield, giving his troops certain instructions that are dependent on the situation. If you have the worm, it will make sure you never know there is a worm by blocking pretty much any site, including antivirus sites and Microsoft sites.
Worms and viruses like these are always interesting to learn about. When I was younger, movies like WarGames and Hackers excited me and made me think of all the possibilities. Uplink is a very fun game that focuses on this sort of thing, and actually immerses you in its' world. When some corporation in the game catches your ip, you double-take and pray to God that government helicopters aren't on their way to send SWAT bursting into your upstairs room and taking you away.
avatar
TheCheese33: Worms and viruses like these are always interesting to learn about. When I was younger, movies like WarGames and Hackers excited me and made me think of all the possibilities.

Oh I haven't seen WarGames in YEARS! Stopping WW3 with 0 player noughts & crosses, sheer genius.
No wait, not genius, that word that sounds like genius... Bullshit! Thats the one!
Fun little film though, wonder if its on DVD in australia...
I've been keeping a casual eye on this (haven't had any issues with it myself), and while it certainly seems like a well-designed worm it probably was only written to create a botnet for spam, DDOS attacks, the usual. To be on the safe side I'll still be disconnecting my home computer before I go to bed tonight, just in case the worm activating results in a surge of propagation attempts and new propagation attacks exploiting currently unknown vulnerabilities. Should be able to check the news from work to see if anything particularly nasty has happened with the worm.
avatar
TheCheese33: The scariest part of the worm lies in the checking of the websites. Orders are given on randomly-created websites, which the worm checks for and follows. It's like a commander watching the battlefield, giving his troops certain instructions that are dependent on the situation. If you have the worm, it will make sure you never know there is a worm by blocking pretty much any site, including antivirus sites and Microsoft sites.
Worms and viruses like these are always interesting to learn about. When I was younger, movies like WarGames and Hackers excited me and made me think of all the possibilities. Uplink is a very fun game that focuses on this sort of thing, and actually immerses you in its' world. When some corporation in the game catches your ip, you double-take and pray to God that government helicopters aren't on their way to send SWAT bursting into your upstairs room and taking you away.

I like collecting malware files. I wish I could dissassemble them somehow and see their code. I got so many resting happily in my virus vault. It's like a collection of little horrors or some evil Pokemon. Best way to collect virii and trojans and anything else malicious and evil is to download random keygen files and just scan them and voila! instant addition to the viral zoo.
avatar
DarrkPhoenix: I've been keeping a casual eye on this (haven't had any issues with it myself), and while it certainly seems like a well-designed worm it probably was only written to create a botnet for spam, DDOS attacks, the usual. To be on the safe side I'll still be disconnecting my home computer before I go to bed tonight, just in case the worm activating results in a surge of propagation attempts and new propagation attacks exploiting currently unknown vulnerabilities. Should be able to check the news from work to see if anything particularly nasty has happened with the worm.

Will disconnecting your internet really even work? It'll just do whatever it's going to do next time you connect, if you even have it.
Post edited March 31, 2009 by anoffday
avatar
anoffday: Will disconnecting your internet really even work? It'll just do whatever it's going to do next time you connect, if you even have it.

It would be useless if I had the worm, but I don't have it, and if I did have it I'd simply remove it. My concern is incoming attacks from other computers that are infected.
avatar
DarrkPhoenix: I've been keeping a casual eye on this (haven't had any issues with it myself), and while it certainly seems like a well-designed worm it probably was only written to create a botnet for spam, DDOS attacks, the usual. To be on the safe side I'll still be disconnecting my home computer before I go to bed tonight, just in case the worm activating results in a surge of propagation attempts and new propagation attacks exploiting currently unknown vulnerabilities.

I wouldn't be too worried about it exploiting new vulnerabilities, since every one they've exploited so far has been well-documented at the time of the agent's release. It seems like Occam's Razor in action: why do independent research to locate buffer/stack overflows, when you can exploit the significant percentage of people who are vulnerable simply due to ignored updates or operator error?
Post edited March 31, 2009 by bremac
avatar
bremac: I wouldn't be too worried about it exploiting new vulnerabilities, since every one they've exploited so far has been well-documented at the time of the agent's release. It seems like Occam's Razor in action: why do independent research to locate buffer/stack overflows, when you can exploit the significant percentage of people who are vulnerable simply due to ignored updates or operator error?

All very true. My worry over the matter is actually extremely minimal; I'm pretty much just flicking off my modem while I'm asleep and at work because it's so trivial a thing to do that it doesn't even really count as a security tradeoff when compared to even the incredibly small risk of the worm suddenly exploiting some zero-day vulnerability.
Just went to Symantec, etc. after my Net got knocked out for some reason. False alarm.
avatar
JudasIscariot: I like collecting malware files. I wish I could dissassemble them somehow and see their code. I got so many resting happily in my virus vault. It's like a collection of little horrors or some evil Pokemon. Best way to collect virii and trojans and anything else malicious and evil is to download random keygen files and just scan them and voila! instant addition to the viral zoo.

It's also a great way to collect harmless files which give false positives, which regularly happens with keygens. You can test them on http://virusscan.jotti.org/
The sites which offer infected downloads are often sites which infect a pc simply by a visit.
In the past I tested my anitivirus program on a handful of such sites and all of them tried to install mallware through means of an infected jar file.