Weeks after leaving the media spotlight, the Conficker malware infection continues to spread, according to experts.
Researchers at Symantec have reported that the malware botnet is still claiming victims at a rate of 50,000 systems per day.
According the researchers, infections are the highest in the United States, Brazil and India. High infection rates were also found in China, Mexico and Italy.
"Well much of the media hype seems to have died down around Conficker/Downadup, but it is still out there spreading far and wide," the researchers wrote.
"In fact the Symantec threat intelligence team estimate there are 50,000 newly infected PCs a day right now."
First appearing in January, the many variants on the Conficker worm spread throughout the early part of the year. When researchers discovered that the third variant of the malware was designed to dial a control server on 1 April, a media storm erupted.
Though Conficker.c failed to perform any sort of significant attack, the malware continued to spread throughout April. Later in the month, researchers discovered that a new variant on the malware was making the rounds.
Since the frenzy over Conficker died down, the malware has been eclipsed in the public eye by more prolific attacks, such as the recent Gumblar infection.
source :Shaun Nichol - itnews.com.au
Showing posts sorted by date for query Conficker. Sort by relevance Show all posts
Showing posts sorted by date for query Conficker. Sort by relevance Show all posts
Saturday, May 23, 2009
Wednesday, April 29, 2009
AutoRun changes in Windows 7
The Microsoft Security Response Center (MSRC) have announced some AutoRun changes for Windows 7.
Currently Conficker and other malware is taking advantage of the AutoRun functionality as a spreading mechanism. AutoRun is used to start some programs automatically when a CD or another media is inserted into a computer. The main purpose of AutoRun is to provide a software response to hardware actions that a user starts on a computer.
In order to help prevent malware from spreading (such as Conficker) using the AutoRun mechanism, the Windows 7 engineering team made two important changes to the product:
For more information please visit the Windows 7 Blog.
source : neowin.net
Currently Conficker and other malware is taking advantage of the AutoRun functionality as a spreading mechanism. AutoRun is used to start some programs automatically when a CD or another media is inserted into a computer. The main purpose of AutoRun is to provide a software response to hardware actions that a user starts on a computer.
In order to help prevent malware from spreading (such as Conficker) using the AutoRun mechanism, the Windows 7 engineering team made two important changes to the product:
- AutoPlay will no longer support the AutoRun functionality for non-optical removable media. In other words, AutoPlay will still work for CD/DVDs but it will no longer work for USB drives. For example, if an infected USB drive is inserted on a machine then the AutoRun task will not be displayed. This will block the increasing social engineer threat highlighted in the SIR. The dialogs below highlight the difference that users will see after this change. Before the change, the malware is leveraging AutoRun (box in red) to confuse the user. After the change, AutoRun will no longer work, so the AutoPlay options are safe
Before the change (left) After the change (right) - A dialog change was done to clarify that the program being executed is running from external media.
Before the change (left) After the change (right)
For more information please visit the Windows 7 Blog.
source : neowin.net
Sunday, April 12, 2009
Conficker also installs fake antivirus software
Researchers have discovered another feature of the Conficker worm that provides an additional clue about the intent of the creators--the worm installs malware that masquerades as antivirus software, Trend Micro said on Friday.
The worm, which has infected millions of Windows-based computers on the Internet, is downloading a program called Spyware Protect 2009 and displaying warning messages saying that the computer is infected and offering to clean it up for $49.95, according to the Trend Micro blog
If you see this pop-up message, chances are your computer is infected with Conficker. The latest feature of the widespread worm is that it installs fake antivirus software on infected machines.
(Credit: Trend Micro)
The infection alerts repeatedly appear and experts are worried that people may be clicking on them and paying for the software just to be rid of the annoying messages, thereby handing thieves their credit card information.
The fake antivirus program also attempts to install a Trojan downloader that is programmed to download new versions of Spyware Protect 2009, according to Kasperky Lab's blog. However, the domain the Trojan downloader was being accessed from has been shut down, the blog said.
The fake antivirus feature further bolsters the speculation that the motivation behind the worm is to make money and not a desire to disrupt computer or network operations.
Researchers were still analyzing new component code of the worm that began being spread via peer-to-peer and being downloaded off domains that host the Waledec worm on Wednesday but were finding the task difficult because the instructions are encrypted.
The worm spreads via a hole in Windows that Microsoft patched in October, as well as through removable storage devices and network shares with weak passwords. The worm disables security software and blocks access to security Web sites.
Despite all the news the worm has made, many computers still remain unpatched, Sophos said. Of the number of people who have used Sophos' free endpoint assessment test to check the security risk of a network since the beginning of the year, 11 percent did not have the Microsoft patch installed, according to Graham Cluley's blog at Sophos.
For the month of March, 10 percent of all of the people who used the Sophos assessment tool were missing the patch, he said. The company did not divulge exactly how many people had used the tool and Cluley said the statistics cannot be extrapolated to represent the number of unpatched systems on the Internet.
In an indication of infection rates, IBM's Internet Security Systems group released statistics that show that the number of unique IPs infected with Conficker.C is increasing slightly.
Based on infections seen through monitoring devices in its IBM ISS' Managed Security Services, the number has grown from just over 64,000 on April 2 to more than 71,000 on April 8, according to the unit's Frequency X blog.
"We've seen around 11 percent more unique IPs in the past few days in comparison to a week ago," the blog said, also adding that the number doesn't necessarily indicate the scope of worldwide Conficker infection.
Nearly 60 percent of the infections monitored by IBM ISS are in Asia, followed by 18 percent each in Europe and South America, and 4 percent in North America, the statistics show. By country, China leads with 16.6 percent, followed by Brazil at 10.8 percent, Russia at 10.2 percent and Korea at 4.6 percent, according to ISS.
To check if your computer is infected you can use this Conficker Eye Chart or this site at the University of Bonn. There is also a Conficker removal guide on CNET's Download.com site.
thanks Elinor Mills
source : news.cnet
The worm, which has infected millions of Windows-based computers on the Internet, is downloading a program called Spyware Protect 2009 and displaying warning messages saying that the computer is infected and offering to clean it up for $49.95, according to the Trend Micro blog
If you see this pop-up message, chances are your computer is infected with Conficker. The latest feature of the widespread worm is that it installs fake antivirus software on infected machines.
(Credit: Trend Micro)
The infection alerts repeatedly appear and experts are worried that people may be clicking on them and paying for the software just to be rid of the annoying messages, thereby handing thieves their credit card information.
The fake antivirus program also attempts to install a Trojan downloader that is programmed to download new versions of Spyware Protect 2009, according to Kasperky Lab's blog. However, the domain the Trojan downloader was being accessed from has been shut down, the blog said.
The fake antivirus feature further bolsters the speculation that the motivation behind the worm is to make money and not a desire to disrupt computer or network operations.
Researchers were still analyzing new component code of the worm that began being spread via peer-to-peer and being downloaded off domains that host the Waledec worm on Wednesday but were finding the task difficult because the instructions are encrypted.
The worm spreads via a hole in Windows that Microsoft patched in October, as well as through removable storage devices and network shares with weak passwords. The worm disables security software and blocks access to security Web sites.
Despite all the news the worm has made, many computers still remain unpatched, Sophos said. Of the number of people who have used Sophos' free endpoint assessment test to check the security risk of a network since the beginning of the year, 11 percent did not have the Microsoft patch installed, according to Graham Cluley's blog at Sophos.
For the month of March, 10 percent of all of the people who used the Sophos assessment tool were missing the patch, he said. The company did not divulge exactly how many people had used the tool and Cluley said the statistics cannot be extrapolated to represent the number of unpatched systems on the Internet.
In an indication of infection rates, IBM's Internet Security Systems group released statistics that show that the number of unique IPs infected with Conficker.C is increasing slightly.
Based on infections seen through monitoring devices in its IBM ISS' Managed Security Services, the number has grown from just over 64,000 on April 2 to more than 71,000 on April 8, according to the unit's Frequency X blog.
"We've seen around 11 percent more unique IPs in the past few days in comparison to a week ago," the blog said, also adding that the number doesn't necessarily indicate the scope of worldwide Conficker infection.
Nearly 60 percent of the infections monitored by IBM ISS are in Asia, followed by 18 percent each in Europe and South America, and 4 percent in North America, the statistics show. By country, China leads with 16.6 percent, followed by Brazil at 10.8 percent, Russia at 10.2 percent and Korea at 4.6 percent, according to ISS.
To check if your computer is infected you can use this Conficker Eye Chart or this site at the University of Bonn. There is also a Conficker removal guide on CNET's Download.com site.
thanks Elinor Mills
source : news.cnet
Friday, April 10, 2009
Update: Conficker, the Internet's No. 1 threat, gets an update
Wily worm uses P-to-P for new instructions; other clues link it to Waledec and the Storm worm
Security researchers say a worm that has infected millions of computers worldwide has been reprogrammed to strengthen its defenses while also trying to attack more machines.
Conficker, which takes advantage of a vulnerability in Microsoft's software, has infected at least 3 million PCs and possibly as many as 12 million, making it into a huge botnet and one of the most severe computer security problems in recent years.
[ IBM has suggested that the number of PCs infected with Conficker may be in the tens of millions. | Beware: Fake security software scammers have been jumping on Conficker. | Learn how to secure your systems with Roger Grimes' Security Adviser blog and newsletter, both from InfoWorld. ]
Botnets can be used to send spam and attack other Web sites, but they need to be able to receive new instructions. Conficker can do this two ways: it can either try to visit a Web site and pick up instructions or it can receive a file over its custom-built encrypted p-to-p (peer-to-peer) network.
Over the last day or so, researchers with Websense and Trend Micro said some PCs infected with Conficker received a binary file over p-to-p. Conficker's controllers have been hampered by efforts of the security community to get directions via a Web site, so they are now using the p-to-p function, said Rik Ferguson, senior security advisor for the vendor Trend Micro.
The new binary tells Conficker to start scanning for other computers that haven't patched the Microsoft vulnerability, Ferguson said. A previous update turned that capability off, which hinted that Conficker's controllers maybe thought the botnet had grown too large.
But now, "it certainly indicates they [Conficker's authors] are seeking to control more machines," Ferguson said.
The new update also tells Conficker to contact MySpace.com, MSN.com, Ebay.com, CNN.com, and AOL.com apparently to confirm that the infected machine is connected to the Internet, Ferguson said. It also blocks infected PCs from visiting some Web sites. Previous Conficker versions wouldn't let people browse to the Web sites of security companies.
In another twist, the binary appears to be programmed to stop running on May 3, which will shut off the new functions, he said.
By Jeremy Kirk
source : infoworld
Security researchers say a worm that has infected millions of computers worldwide has been reprogrammed to strengthen its defenses while also trying to attack more machines.
Conficker, which takes advantage of a vulnerability in Microsoft's software, has infected at least 3 million PCs and possibly as many as 12 million, making it into a huge botnet and one of the most severe computer security problems in recent years.
[ IBM has suggested that the number of PCs infected with Conficker may be in the tens of millions. | Beware: Fake security software scammers have been jumping on Conficker. | Learn how to secure your systems with Roger Grimes' Security Adviser blog and newsletter, both from InfoWorld. ]
Botnets can be used to send spam and attack other Web sites, but they need to be able to receive new instructions. Conficker can do this two ways: it can either try to visit a Web site and pick up instructions or it can receive a file over its custom-built encrypted p-to-p (peer-to-peer) network.
Over the last day or so, researchers with Websense and Trend Micro said some PCs infected with Conficker received a binary file over p-to-p. Conficker's controllers have been hampered by efforts of the security community to get directions via a Web site, so they are now using the p-to-p function, said Rik Ferguson, senior security advisor for the vendor Trend Micro.
The new binary tells Conficker to start scanning for other computers that haven't patched the Microsoft vulnerability, Ferguson said. A previous update turned that capability off, which hinted that Conficker's controllers maybe thought the botnet had grown too large.
But now, "it certainly indicates they [Conficker's authors] are seeking to control more machines," Ferguson said.
The new update also tells Conficker to contact MySpace.com, MSN.com, Ebay.com, CNN.com, and AOL.com apparently to confirm that the infected machine is connected to the Internet, Ferguson said. It also blocks infected PCs from visiting some Web sites. Previous Conficker versions wouldn't let people browse to the Web sites of security companies.
In another twist, the binary appears to be programmed to stop running on May 3, which will shut off the new functions, he said.
By Jeremy Kirk
source : infoworld
Researchers say Conficker is all about the money
The Conficker worm that has infected millions of Windows-based computers will likely be used to send spam and steal data much like one of the nastiest botnets on the Internet does, researchers said on Thursday after finding links between the two worms.
A week after failing to do anything but snore, the much hyped Conficker worm was roused from its slumber on Wednesday, with infected computers transmitting updates via peer-to-peer and dropping a mystery payload onto PCs. Researchers suspect that the payload program may be a keystroke logger, a spam generator, or both.
Conficker now also tries to connect to MySpace.com, MSN.com, eBay.com, CNN.com, and AOL.com as a way to test that the computer has Internet connectivity, deletes all traces of itself in the host machine, and is set to shut down some functionality on May 3.
In addition, Conficker reaches out to a domain that is known to be infected by a worm called Waledac and downloads an encrypted file. Researchers are analyzing that code and the program that is dropped directly onto infected machines by other infected machines to find out exactly what is in it. And they suspect that Conficker and Waledac are coming from the same people.
"I'm pretty certain the same people are behind both of them," said Paul Ferguson, an advanced threats researcher for Trend Micro. "Conficker has got their (Waledac creators') fingerprints all over it."
Computers infected with Waledac comprise what Ferguson called the "most pernicious spamming botnet on the Internet." Waledac spreads via a malicious Web link or an e-mail, typically a fake Christmas greeting or Valentine's Day message, or with a subject line related to the inauguration of President Obama. It generates spam and steals data, like passwords, from infected computers.
Ferguson said he believes Eastern Europeans are behind the Waledac worm. He suspects they created the Storm botnet to try different payloads and business models and that Waledac resulted from that. Ferguson speculates that they may be putting their lessons learned from earlier efforts into practice with Conficker.
"There is empirical evidence that these guys are a for-hire, for-profit criminal operation on the Internet and that Conficker is nothing more than part of that organization's best efforts to monetize their efforts on the Internet," Ferguson said.
Vincent Weafer, vice president of Symantec Security Response, confirmed the Waledac connection with Conficker, but wouldn't speculate on who exactly might be spreading the worms. The fact that Conficker now downloads a Waledac file "reconfirms our belief that ultimately this is a large botnet designed to make money," he said. "It's the first example of how these guys are trying to leverage this botnet for profit."
As for the May 3 expiration date in the latest Conficker code, Weafer said it appears to be trying to shut down code related to the first variant of Conficker, Conficker.A, which generated more noise on the Internet than later versions did.
Symantec researchers are calling the latest Conficker code that is circulating a new variant of the worm and have dubbed it Downadup.E, with Downadup being another name for Conficker.
The worm spreads via a hole in Windows that Microsoft patched in October, as well as through removable storage devices and network shares with weak passwords. The worm disables security software and blocks access to security Web sites.
To check if your computer is infected you can use this Conficker Eye Chart or this site at the University of Bonn. There is also a Conficker removal guide on CNET's Download.com site.
People are being urged to be careful in their quest for Conficker removal tools. Marshale8e6 has found spam that takes advantage of the hype over the Conficker worm to scare people into installing fake antivirus software. The e-mail messages claim to be from Microsoft security departments and provide a link to a Web page that does a fake computer scan and prompts the visitor to buy antivirus software that typically does nothing but install malware on the computer.
Also, using search engines to try to find Conficker removal tools is maybe not the best idea. Trend Micro has found that Google searches using terms related to Conficker bring up results that include links to malware. They recommend going directly to the site of a trusted security vendor to get software instead of doing general searches.
Meanwhile, Conficker also has inspired a copycat worm. Neeris, an IRC bot that spreads itself by sending links through MSN Messenger, has been active for a few years, but a new variant has emerged that borrows some behavior from Conficker, such as exploiting the same hole in Windows that Conficker does and spreading via removable storage devices, Microsoft said
thanks Elinor Mills
source : news.cnet
A week after failing to do anything but snore, the much hyped Conficker worm was roused from its slumber on Wednesday, with infected computers transmitting updates via peer-to-peer and dropping a mystery payload onto PCs. Researchers suspect that the payload program may be a keystroke logger, a spam generator, or both.
Conficker now also tries to connect to MySpace.com, MSN.com, eBay.com, CNN.com, and AOL.com as a way to test that the computer has Internet connectivity, deletes all traces of itself in the host machine, and is set to shut down some functionality on May 3.
In addition, Conficker reaches out to a domain that is known to be infected by a worm called Waledac and downloads an encrypted file. Researchers are analyzing that code and the program that is dropped directly onto infected machines by other infected machines to find out exactly what is in it. And they suspect that Conficker and Waledac are coming from the same people.
"I'm pretty certain the same people are behind both of them," said Paul Ferguson, an advanced threats researcher for Trend Micro. "Conficker has got their (Waledac creators') fingerprints all over it."
Computers infected with Waledac comprise what Ferguson called the "most pernicious spamming botnet on the Internet." Waledac spreads via a malicious Web link or an e-mail, typically a fake Christmas greeting or Valentine's Day message, or with a subject line related to the inauguration of President Obama. It generates spam and steals data, like passwords, from infected computers.
Ferguson said he believes Eastern Europeans are behind the Waledac worm. He suspects they created the Storm botnet to try different payloads and business models and that Waledac resulted from that. Ferguson speculates that they may be putting their lessons learned from earlier efforts into practice with Conficker.
"There is empirical evidence that these guys are a for-hire, for-profit criminal operation on the Internet and that Conficker is nothing more than part of that organization's best efforts to monetize their efforts on the Internet," Ferguson said.
Vincent Weafer, vice president of Symantec Security Response, confirmed the Waledac connection with Conficker, but wouldn't speculate on who exactly might be spreading the worms. The fact that Conficker now downloads a Waledac file "reconfirms our belief that ultimately this is a large botnet designed to make money," he said. "It's the first example of how these guys are trying to leverage this botnet for profit."
As for the May 3 expiration date in the latest Conficker code, Weafer said it appears to be trying to shut down code related to the first variant of Conficker, Conficker.A, which generated more noise on the Internet than later versions did.
Symantec researchers are calling the latest Conficker code that is circulating a new variant of the worm and have dubbed it Downadup.E, with Downadup being another name for Conficker.
The worm spreads via a hole in Windows that Microsoft patched in October, as well as through removable storage devices and network shares with weak passwords. The worm disables security software and blocks access to security Web sites.
To check if your computer is infected you can use this Conficker Eye Chart or this site at the University of Bonn. There is also a Conficker removal guide on CNET's Download.com site.
People are being urged to be careful in their quest for Conficker removal tools. Marshale8e6 has found spam that takes advantage of the hype over the Conficker worm to scare people into installing fake antivirus software. The e-mail messages claim to be from Microsoft security departments and provide a link to a Web page that does a fake computer scan and prompts the visitor to buy antivirus software that typically does nothing but install malware on the computer.
Also, using search engines to try to find Conficker removal tools is maybe not the best idea. Trend Micro has found that Google searches using terms related to Conficker bring up results that include links to malware. They recommend going directly to the site of a trusted security vendor to get software instead of doing general searches.
Meanwhile, Conficker also has inspired a copycat worm. Neeris, an IRC bot that spreads itself by sending links through MSN Messenger, has been active for a few years, but a new variant has emerged that borrows some behavior from Conficker, such as exploiting the same hole in Windows that Conficker does and spreading via removable storage devices, Microsoft said
thanks Elinor Mills
source : news.cnet
Thursday, April 9, 2009
Bitdefender Discovers New Conficker Variant
The malware researchers from anti-virus vendor Bitdefender have identified a new variant of the infamous Conficker worm. Its analysis has revealed an improved obfuscation layer and additional blocked strings. Conficker, also known as Downadup or Kido, is one of the most complex and well-written pieces of malware that security researchers have seen in recent years. The original variant, Conficker.A, appeared back in November 2008, soon after Microsoft broke its patch cycle in order to release MS08-067, a fix for...
December 2008 saw the release of Conficker.B, the most successful variant to date, which infected an estimated number of 12 million computers at its peak. This was followed by another seriously revamped version, initially dubbed Conficker.B++. Security experts speculated that this update aimed at combating the efforts of the Conficker Cabal, a coalition of industry organizations and companies collaborating to fight the worm. Conficker.B++ is currently better known as Conficker.C.
Bitdefender announced yesterday that it had identified a new variant, but details were scarce, as it was still being analyzed. New information will be posted when it becomes available, the company's press release reads. However, our inside sources at Bitdefender have been able to provide us with more insight into this incident.
New Conficker variant blocked by Bitdefender Antivirus
Enlarge picture
According to them, the analysts got suspicious after a customer reported that he could not access www.bdtools.net, the website used by Bitdefender to host free removal tools, from his computer infected with Conficker. This was particularly interesting, because the domain name was not amongst the ones blocked by the known variants of the worm. After securing a sample and analyzing it, the researchers concluded that they were dealing with a new version.
Even though it does not bring radical changes, like Conficker.B or Conficker.C do, this variation has an extended blacklist. The newly added strings, used by the worm to block access to domains or executables containing them, are: precisesecurity, ms-mvp, mitre, enigma, bdtools, av-sc, adware, activescan, stinger, kill, cfremo and bd_rem. Downadup also features two layers of obfuscation to prevent analysis and detection. However, our sources have informed us that, in this variant, the primary obfuscation layer is heavily modified and seems to have been particularly designed to block emulation.
Bitdefender has determined that this new version has actually been in circulation since around March 18th, but pretty much passed unobserved. It is currently detected as Win32.Worm.Downadup.Gen, under a generic routine able to identify any known variant of Conficker. The users who cannot access the www.bdtools.net website in order to obtain Bitdefender's free Conficker removal tool can download it from our secure servers. Furthermore, people having trouble executing the tool on infected computers, should rename it to something random and try again.
source : news.softpedia
Conficker spreads via peer-to-peer
The Conficker worm is finally doing something--updating via peer-to-peer between infected computers and dropping a mystery payload on infected computers, Trend Micro said on Wednesday.
Researchers were analyzing the code of the software that is being dropped onto infected computers but suspect that it is a keystroke logger or some other program designed to steal sensitive data off the machine, said David Perry, global director of security education at Trend Micro.
The worm also tries to connect to MySpace.com, MSN.com, eBay.com, CNN.com and AOL.com as a way to test that the computer has Internet connectivity, deletes all traces of itself in the host machine, and is set to shut down on May 3, according to the TrendLabs Malware Blog.
Because infected computers are receiving the new component in a staggered manner rather than all at once there should be no disruption to the Web sites the computers visit, said Paul Ferguson, advanced threats researcher for Trend Micro.
"After May 3, it shuts down and won't do any replication," Perry said. However, infected computers could still be remotely controlled to do something else, he added.
Last night Trend Micro researchers noticed a new file in the Windows Temp folder and a huge encrypted TCP response from a known Conficker P2P IP node hosted in Korea.
"As expected, the P2P communications of the Downad/Conficker botnet may have just been used to serve an update, and not via HTTP," the blog post says. "The Conficker/Downad P2P communications is now running in full swing!"
In addition to adding the new propagation functionality, Conficker communicates with servers that are associated with the Waledac family of malware and its Storm botnet, according to a separate blog post by Trend Micro security researcher Rik Ferguson.
The worm tries to access a known Waledac domain and download another encrypted file, the researchers said.
Conficker.C failed to make a splash a week ago despite the fact that it was programmed to activate on April 1.
Initially, researchers thought they were seeing a new variant of the Conficker worm, but now they believe it is merely a new component of the worm.
The worm spreads via a hole in Windows that Microsoft patched in October, as well as through removable storage devices and network shares with weak passwords.
thanks : Elinor Mills
source : cnet
Tuesday, April 7, 2009
Conficker copycat prowls for victims, says Microsoft
Four-year-old Neeris worm copies Conficker's attack strategies
An old, but little-known worm has copied some of the infection strategies of Conficker, the worm that raised a ruckus last week, Microsoft security researchers said late Friday.
Neeris, which harks to May 2005, is now exploiting the same Windows bug that Conficker put to good use, and is spreading through flash drives, another Conficker characteristic, said Ziv Mador and Aaron Putnam, researchers with the Microsoft Malware Protection Center.
[ IBM's estimates suggest that tens of millions of PCs may be infected by Conficker. | Learn how to secure your systems with Roger Grimes' Security Adviser blog and newsletter, both from InfoWorld. ]
According to Mador and Putnam, Neeris' makers recently added an exploit for the MS08-067 vulnerability that Microsoft patched last October. The emergency update -- one of the rare times Microsoft has issued a patch outside its usual monthly scheduled --- fixed a flaw in the Windows Server service, which is used for file- and print-sharing by Windows PCs.
Conficker, the worm that began using a new communications scheme to receive commands from its hacker controllers last Wednesday, exploited the same MS08-067 vulnerability to devastating effect in late 2008 and early 2009. During January, for instance, Conficker infected millions of machines, many of them by exploiting MS08-067.
"Neeris [also] spreads via Autorun," Mador and Putnam said in an entry to the malware center's blog. "The new Neeris variant even adds the same 'Open folder to view files' AutoPlay option that Conficker does."
Conficker spread from infected PCs by adding an autorun.inf file to the root directory of any USB-based device, primarily flash drives. Later, when the drive was connected to an uninfected computer, the autorun.inf file silently copied the worm to the machine.
By Gregg Keizer
source : infoworld
An old, but little-known worm has copied some of the infection strategies of Conficker, the worm that raised a ruckus last week, Microsoft security researchers said late Friday.
Neeris, which harks to May 2005, is now exploiting the same Windows bug that Conficker put to good use, and is spreading through flash drives, another Conficker characteristic, said Ziv Mador and Aaron Putnam, researchers with the Microsoft Malware Protection Center.
[ IBM's estimates suggest that tens of millions of PCs may be infected by Conficker. | Learn how to secure your systems with Roger Grimes' Security Adviser blog and newsletter, both from InfoWorld. ]
According to Mador and Putnam, Neeris' makers recently added an exploit for the MS08-067 vulnerability that Microsoft patched last October. The emergency update -- one of the rare times Microsoft has issued a patch outside its usual monthly scheduled --- fixed a flaw in the Windows Server service, which is used for file- and print-sharing by Windows PCs.
Conficker, the worm that began using a new communications scheme to receive commands from its hacker controllers last Wednesday, exploited the same MS08-067 vulnerability to devastating effect in late 2008 and early 2009. During January, for instance, Conficker infected millions of machines, many of them by exploiting MS08-067.
"Neeris [also] spreads via Autorun," Mador and Putnam said in an entry to the malware center's blog. "The new Neeris variant even adds the same 'Open folder to view files' AutoPlay option that Conficker does."
Conficker spread from infected PCs by adding an autorun.inf file to the root directory of any USB-based device, primarily flash drives. Later, when the drive was connected to an uninfected computer, the autorun.inf file silently copied the worm to the machine.
By Gregg Keizer
source : infoworld
Monday, March 30, 2009
'60 Minutes': What's next for the Conficker worm?
The following is a transcript of a "60 Minutes" report on Internet viruses that aired Sunday.
The Internet is infected. Malicious computer hackers have been creating more and more weapons that they plant on the Internet. They call their weapons viruses and worms--they're creepy, crawly toxic software that contaminate our computers without our ever knowing it. You can be infected by simply visiting your favorite Web site, or just by leaving your computer on, overnight while you're asleep.
And the problem is growing, exponentially. Last year the number of infections tripled. And an entire industry of computer security professionals is in a race to keep the hackers from their goal, which is usually to steal your money.
One of the most dangerous threats ever, a computer worm known as "Conficker," is spreading through the Internet right now. By some estimates, 10 million computers have been infected worldwide.
At Symantec, the company that makes Norton antivirus software, engineers have been tracking Conficker since last November as it worms its way across the globe.
"This map is showing a visual representation of where all of the known infections of Conficker are across the world," explained Steve Trilling, a Symantec vice president who says the worm is now living on millions of computers, mainly in corporations.
So far, the bad guys who created it haven't triggered Conficker. It's just sitting out there like a sleeper cell.
"Imagine a network of spies that has infiltrated a country. And every day, all of the spies are calling in for their instructions on what to do next," Trilling explained.
Asked what the worm is being asked to do, Trilling told Stahl, "That's the interesting thing. The only thing the worm is being asked to do is to ask for further instructions."
For several months, Trilling says the worm has just been sitting there, awaiting instructions.
It's that ominous, because once the hackers issue instructions, Conficker could turn menacing in an instant.
With one click, the worm's creator can instruct it to suck sensitive data, like bank passwords and account numbers, out of millions of computers, or launch a massive spam attack to clog up the works.
The newest targets of worms are social networking sites. Trilling demonstrated to Stahl how it might work.
Looking at a real Facebook page, Trilling explained, "We added your friend and colleague Morley Safer, you can see down there on the left."
He says a worm can crack into a Facebook account, like Morley's, and send a message to anyone on his friends list.
It's a message a friend or colleague, like Stahl, would be sure to open since it comes from a trusted friend. Stahl took the bait and clicked on what looked like Morley's video link.
"Something looks a little off," Trilling remarked. "You're already infected."
As Trilling demonstrated on a second screen, the hacker "owned" Stahl's online movements. "From here on out, everything you do, gonna show up on the hacker's machine," he explained.
So when Stahl typed her username and password into a bank Web site, it appeared instantaneously on the hacker's screen, along with her bank account details.
"Every single keystroke you hit, in fact, if you make a mistake and hit a backspace, that shows up in the window," Trilling explained.
The hacker then followed her around, as she browsed the Internet from CBS News to Amazon.com.
"So, if I buy something, they're gonna have my credit card," Stahl remarked.
"Everything you type in, your address, your credit card, it's all gonna show up in that window," Trilling warned.
A minefield on the Internet
The Internet has become a minefield. Hackers have hidden their malicious software known as "malware" on some of the most trusted Web sites, like eBay, the Miami Dolphins football team, even my.barackobama.com.
Trilling says too few people have top-notch, up-to-date security software.
"There is something that would have prevented me from answering Morley's message. Or I would never have gotten Morley's message?" Stahl asked.
"As soon as you clicked on that link and you had security software, you would immediately get an alert. 'This is a bad Web site.' And it would have blocked the attack. You would have never been hit. Putting on that software, you're preventing yourself from becoming a victim," Trilling advised.
But according to Symantec's own figures, the hackers are inventing up to 15,000 new infections every day, designed specifically to get around the latest anti-virus protections. Symantec has to send out updates every five minutes.
"You sell the antivirus, anti-worm stuff. I mean, how do I know you're not just saying, 'Go out and get this,' 'cause you sell it? I mean, you know... there's a sort of conflict of interest here," Stahl pointed out.
"Well look, Lesley, in 60 minutes we are blocking nearly 400,000 threats around the world. If you're goin' out on the Internet and you're not protected, it's like walkin' outta your house and leavin' the door open," Trilling argued.
But Mary Rappaport says all the doors on her home computer were locked tight. She had antivirus software and a firewall, and so she thought she was safe to do her banking online. But then she noticed something odd going on and called the bank.
"They told me that three charges in the last three days had been made to my account. One for $3,000, one for $4,000, and one for $1,200," she recalled.
Rappaport knew she had to act quickly.
The bank replaced the stolen money and suggested that she merely change her password. That was to be the end of it. But the next day, she was checking her balance. "And I saw $1,000 being moved from my son's savings account into my checking account," she recalled. "Right before my eyes. I saw my money being moved."
A hacker was trying to move all her money into one account, her checking account, to make it easier to transfer overseas. Luckily, the bank was able to freeze her accounts before she lost any more money.
"I had what I thought were adequate protections. You know, I had anti-spyware software," she said. "And antivirus."
"And I thought I had a good enough firewall. Wrong!" Rappaport told Stahl. "My understanding anyway is that they were able to get some sort of bug onto my system that disabled the ability to update these software programs."
Mary suspects her teenage sons picked up the bug while downloading from music or game Web sites. But it could have come from any number of Web sites.
Going to Google
Stahl asked Google what they're doing to deal with these big problems, because their search engine is what most people use to surf the net.
Stahl went to talk to Vint Cerf, one of the founding fathers of the Internet, and now a vice president at Google. The company itself says that one in every 100 Google searches brings up an infected site.
"People are blaming Google 'cause if you do the search, they say, you--Google--should be responsible if we get infected," Stahl remarked. "Now you've heard that."
"I have heard that, and I think that's a very bizarre way of looking at things," Cerf replied.
Google's position is that it's not the policeman of the Internet, but its engineers do scour the Web and issue warnings about malicious infections, or malware.
"If we happen to see what we believe is malware on that Web site, then when you go there we will pop up a Web page and it says, 'We think we found malware on this site. Maybe you don't want to go there,'" Cerf explained.
"Now I understand that if you go there anyway, Google sends you a second warning, saying: 'Are you kidding? Are you serious? We told you not to go there.' Something like that," Stahl said.
"Of course people still go," Cerf acknowledged. "And at that point it's their problem."
"The more you hear about this, the more you feel that if you bank online, shop online, open an e-mail, I mean, that almost anything you do puts you in jeopardy," Stahl remarked.
"That's a true statement. There are things. Bad things can happen. On the other hand, I've been on the Net ever since the Net started, and I haven't had any of the bad problems that you've described," Cerf replied.
But tens of millions of people have--one if four Americans, according to recent reports, as the hackers get more and more sophisticated.
Hunting hackers
Don Jackson is a hacker hunter. He is director of threat intelligence at SecureWorks in Atlanta, which protects corporations against cyber-attacks and tracks the hackers who launch them.
"Part of my job is to know the enemy, to know our adversaries," he explained.
To Jackson, the enemy is a hacker. "An enemy is somebody who wants to use computers to hurt somebody else or to make money for themselves."
Using an assumed name, "Gozi," Jackson infiltrates chat rooms where hackers sell their worms and viruses to their clients: other hackers. He asks for a demo so his company can create software to disable the malware. The hackers, he says, are typically young, male and often from Russia.
Asked how he tracks them down, Jackson said, "Well, they're like any other business. They have to advertise to get clients."
As Jackson explains, these brazen hackers do this openly on the Internet. "Unfortunately they're all too easy to find," he said.
He says many Russian hackers are in cyber-gangs that display fascist symbols, like a Swastika and anti-American artwork. They boast about all the dollars they've stolen from the rich Americans. A single hacker can make $30,000 a month and be championed in local newspapers.
"There's an example recently where two boys were arrested actually and then let go the next day, but the article in the newspaper wasn't that they were arrested and that they committed a crime, but saying: 'Look at our two local boys made good. They've cheated some greedy Westerners out of so much money,'" Jackson explained.
"They're heroes," Stahl remarked.
"They are," he agreed. "And it's bringing money into the local economy."
Russian authorities tend to look the other way, which explains why members of the cyber gangs have no fear. They even show their faces on the Internet.
One of the hackers, who calls himself "Tempest," is just 14 years old and working full time. "So he can't legally drive a car and he can't join the army, but he can hack into banks and siphon money out," Jackson remarked.
It's not known who's behind the computer worm Conficker, whether it's a gang of Russian hackers or some solitary evil genius. This worm is wily--it keeps mutating. Security software companies have been kept very busy.
But Conficker can jump over protections. While Stahl was reporting this story in early March, she was stunned to learn that the wily worm had struck CBS News.
"People were havin' problems with their BlackBerries, their logons," explained Louie Pelaez, a network engineer.
He says Conficker is so aggressive, it took CBS technicians 24/7 over 10 days to hunt down and quarantine the affected computers.
"Do you actually know where it started? Can you pinpoint it?" Stahl asked.
"We really will probably never know exactly how it infected the network," Pelaez said. "We just know that, you know, once it hit, it began to propagate."
CBS News has now contained the infection, but Pelaez says Conficker could still be hiding undetected somewhere within the network.
Asked if he thinks CBS is safe, or if this could happen again, Pelaez told Stahl, "No, I pretty much thought that we were pretty solid. You try to secure a network. But there's no guarantee that somebody can't come up with something that will, you know, wreak havoc."
Conficker investigators have been talking about an April Fool's attack, because in dissecting the worm, they can see it's been programmed to receive new instructions on April 1. But nobody knows if the instructions will be benign, or something that could disrupt the entire Internet.
source :news.cnet.com
The Internet is infected. Malicious computer hackers have been creating more and more weapons that they plant on the Internet. They call their weapons viruses and worms--they're creepy, crawly toxic software that contaminate our computers without our ever knowing it. You can be infected by simply visiting your favorite Web site, or just by leaving your computer on, overnight while you're asleep.
And the problem is growing, exponentially. Last year the number of infections tripled. And an entire industry of computer security professionals is in a race to keep the hackers from their goal, which is usually to steal your money.
One of the most dangerous threats ever, a computer worm known as "Conficker," is spreading through the Internet right now. By some estimates, 10 million computers have been infected worldwide.
At Symantec, the company that makes Norton antivirus software, engineers have been tracking Conficker since last November as it worms its way across the globe.
"This map is showing a visual representation of where all of the known infections of Conficker are across the world," explained Steve Trilling, a Symantec vice president who says the worm is now living on millions of computers, mainly in corporations.
So far, the bad guys who created it haven't triggered Conficker. It's just sitting out there like a sleeper cell.
"Imagine a network of spies that has infiltrated a country. And every day, all of the spies are calling in for their instructions on what to do next," Trilling explained.
Asked what the worm is being asked to do, Trilling told Stahl, "That's the interesting thing. The only thing the worm is being asked to do is to ask for further instructions."
For several months, Trilling says the worm has just been sitting there, awaiting instructions.
It's that ominous, because once the hackers issue instructions, Conficker could turn menacing in an instant.
With one click, the worm's creator can instruct it to suck sensitive data, like bank passwords and account numbers, out of millions of computers, or launch a massive spam attack to clog up the works.
The newest targets of worms are social networking sites. Trilling demonstrated to Stahl how it might work.
Looking at a real Facebook page, Trilling explained, "We added your friend and colleague Morley Safer, you can see down there on the left."
He says a worm can crack into a Facebook account, like Morley's, and send a message to anyone on his friends list.
It's a message a friend or colleague, like Stahl, would be sure to open since it comes from a trusted friend. Stahl took the bait and clicked on what looked like Morley's video link.
"Something looks a little off," Trilling remarked. "You're already infected."
As Trilling demonstrated on a second screen, the hacker "owned" Stahl's online movements. "From here on out, everything you do, gonna show up on the hacker's machine," he explained.
So when Stahl typed her username and password into a bank Web site, it appeared instantaneously on the hacker's screen, along with her bank account details.
"Every single keystroke you hit, in fact, if you make a mistake and hit a backspace, that shows up in the window," Trilling explained.
The hacker then followed her around, as she browsed the Internet from CBS News to Amazon.com.
"So, if I buy something, they're gonna have my credit card," Stahl remarked.
"Everything you type in, your address, your credit card, it's all gonna show up in that window," Trilling warned.
A minefield on the Internet
The Internet has become a minefield. Hackers have hidden their malicious software known as "malware" on some of the most trusted Web sites, like eBay, the Miami Dolphins football team, even my.barackobama.com.
Trilling says too few people have top-notch, up-to-date security software.
"There is something that would have prevented me from answering Morley's message. Or I would never have gotten Morley's message?" Stahl asked.
"As soon as you clicked on that link and you had security software, you would immediately get an alert. 'This is a bad Web site.' And it would have blocked the attack. You would have never been hit. Putting on that software, you're preventing yourself from becoming a victim," Trilling advised.
But according to Symantec's own figures, the hackers are inventing up to 15,000 new infections every day, designed specifically to get around the latest anti-virus protections. Symantec has to send out updates every five minutes.
"You sell the antivirus, anti-worm stuff. I mean, how do I know you're not just saying, 'Go out and get this,' 'cause you sell it? I mean, you know... there's a sort of conflict of interest here," Stahl pointed out.
"Well look, Lesley, in 60 minutes we are blocking nearly 400,000 threats around the world. If you're goin' out on the Internet and you're not protected, it's like walkin' outta your house and leavin' the door open," Trilling argued.
But Mary Rappaport says all the doors on her home computer were locked tight. She had antivirus software and a firewall, and so she thought she was safe to do her banking online. But then she noticed something odd going on and called the bank.
"They told me that three charges in the last three days had been made to my account. One for $3,000, one for $4,000, and one for $1,200," she recalled.
Rappaport knew she had to act quickly.
The bank replaced the stolen money and suggested that she merely change her password. That was to be the end of it. But the next day, she was checking her balance. "And I saw $1,000 being moved from my son's savings account into my checking account," she recalled. "Right before my eyes. I saw my money being moved."
A hacker was trying to move all her money into one account, her checking account, to make it easier to transfer overseas. Luckily, the bank was able to freeze her accounts before she lost any more money.
"I had what I thought were adequate protections. You know, I had anti-spyware software," she said. "And antivirus."
"And I thought I had a good enough firewall. Wrong!" Rappaport told Stahl. "My understanding anyway is that they were able to get some sort of bug onto my system that disabled the ability to update these software programs."
Mary suspects her teenage sons picked up the bug while downloading from music or game Web sites. But it could have come from any number of Web sites.
Going to Google
Stahl asked Google what they're doing to deal with these big problems, because their search engine is what most people use to surf the net.
Stahl went to talk to Vint Cerf, one of the founding fathers of the Internet, and now a vice president at Google. The company itself says that one in every 100 Google searches brings up an infected site.
"People are blaming Google 'cause if you do the search, they say, you--Google--should be responsible if we get infected," Stahl remarked. "Now you've heard that."
"I have heard that, and I think that's a very bizarre way of looking at things," Cerf replied.
Google's position is that it's not the policeman of the Internet, but its engineers do scour the Web and issue warnings about malicious infections, or malware.
"If we happen to see what we believe is malware on that Web site, then when you go there we will pop up a Web page and it says, 'We think we found malware on this site. Maybe you don't want to go there,'" Cerf explained.
"Now I understand that if you go there anyway, Google sends you a second warning, saying: 'Are you kidding? Are you serious? We told you not to go there.' Something like that," Stahl said.
"Of course people still go," Cerf acknowledged. "And at that point it's their problem."
"The more you hear about this, the more you feel that if you bank online, shop online, open an e-mail, I mean, that almost anything you do puts you in jeopardy," Stahl remarked.
"That's a true statement. There are things. Bad things can happen. On the other hand, I've been on the Net ever since the Net started, and I haven't had any of the bad problems that you've described," Cerf replied.
But tens of millions of people have--one if four Americans, according to recent reports, as the hackers get more and more sophisticated.
Hunting hackers
Don Jackson is a hacker hunter. He is director of threat intelligence at SecureWorks in Atlanta, which protects corporations against cyber-attacks and tracks the hackers who launch them.
"Part of my job is to know the enemy, to know our adversaries," he explained.
To Jackson, the enemy is a hacker. "An enemy is somebody who wants to use computers to hurt somebody else or to make money for themselves."
Using an assumed name, "Gozi," Jackson infiltrates chat rooms where hackers sell their worms and viruses to their clients: other hackers. He asks for a demo so his company can create software to disable the malware. The hackers, he says, are typically young, male and often from Russia.
Asked how he tracks them down, Jackson said, "Well, they're like any other business. They have to advertise to get clients."
As Jackson explains, these brazen hackers do this openly on the Internet. "Unfortunately they're all too easy to find," he said.
He says many Russian hackers are in cyber-gangs that display fascist symbols, like a Swastika and anti-American artwork. They boast about all the dollars they've stolen from the rich Americans. A single hacker can make $30,000 a month and be championed in local newspapers.
"There's an example recently where two boys were arrested actually and then let go the next day, but the article in the newspaper wasn't that they were arrested and that they committed a crime, but saying: 'Look at our two local boys made good. They've cheated some greedy Westerners out of so much money,'" Jackson explained.
"They're heroes," Stahl remarked.
"They are," he agreed. "And it's bringing money into the local economy."
Russian authorities tend to look the other way, which explains why members of the cyber gangs have no fear. They even show their faces on the Internet.
One of the hackers, who calls himself "Tempest," is just 14 years old and working full time. "So he can't legally drive a car and he can't join the army, but he can hack into banks and siphon money out," Jackson remarked.
It's not known who's behind the computer worm Conficker, whether it's a gang of Russian hackers or some solitary evil genius. This worm is wily--it keeps mutating. Security software companies have been kept very busy.
But Conficker can jump over protections. While Stahl was reporting this story in early March, she was stunned to learn that the wily worm had struck CBS News.
"People were havin' problems with their BlackBerries, their logons," explained Louie Pelaez, a network engineer.
He says Conficker is so aggressive, it took CBS technicians 24/7 over 10 days to hunt down and quarantine the affected computers.
"Do you actually know where it started? Can you pinpoint it?" Stahl asked.
"We really will probably never know exactly how it infected the network," Pelaez said. "We just know that, you know, once it hit, it began to propagate."
CBS News has now contained the infection, but Pelaez says Conficker could still be hiding undetected somewhere within the network.
Asked if he thinks CBS is safe, or if this could happen again, Pelaez told Stahl, "No, I pretty much thought that we were pretty solid. You try to secure a network. But there's no guarantee that somebody can't come up with something that will, you know, wreak havoc."
Conficker investigators have been talking about an April Fool's attack, because in dissecting the worm, they can see it's been programmed to receive new instructions on April 1. But nobody knows if the instructions will be benign, or something that could disrupt the entire Internet.
source :news.cnet.com
Sunday, March 29, 2009
Melissa virus turns 10
A decade ago there was no Facebook, no iPhone, and no Conficker. There was dial-up and AOL and a nasty virus called Melissa that ended up being the fastest spreading virus at the time.
CNET News talked to Dmitry Graznov, a senior research architect at McAfee Avert Labs who was among the researchers who worked to fight the Melissa outbreak and track down the creator.
Q: How was Melissa discovered?
Graznov: Avert as a whole discovered it as did some of the competitors. It was submitted to us by customers as it started to spread around the world (on March 26, 1999).
What made Melissa different from previous viruses?
Graznov: It was the first mass-mailing virus, which used e-mail to spread on a large scale.
What harm did the virus do?
Graznov: In some cases the load on the e-mail servers in some organizations was so high that the servers were effectively shut down.
How many computers were affected and what did the virus do?
Graznov: Hundreds of thousands of computers were affected. That's a guess...Melissa infected other documents a user opened in Microsoft Word. It also connected to Outlook if it was running and selected 50 entries in the address book and e-mailed an infected document to those addresses...including mailing lists...As a result, the virus was sent not just to 50 people, but to thousands of people easily. We didn't have any firm numbers to go by, but we did have reports from customers saying their Exchange servers were overwhelmed.
How long did the outbreak last?
Graznov: Several days, but the infections continued to be registered for a long time after that. It was just a macro virus and we were well equipped to provide detection and removal for people's computers even then...The fact that it was so widespread in the world already meant it took a long time to remove the infections.
Security researcher Dmitry Graznov as he looked in 1999 when he was chasing down the creator of the Melissa virus for McAfee Avert Labs.
(Credit: Dmitry Graznov)
How did the virus writer get caught?
Graznov: I was running, actually still am, a project called Usenet Virus Patrol, which scans Usenet articles for viruses. The author of Melissa posted the virus to a newsgroup called "alt.sex." It was zipped up and sent as if it was a list of passwords to like 80-something different porno sites...It was just bait to entice people into downloading it and opening it. Once it was opened, it started e-mailing itself around. It was relatively easy to go back and find the exact Usenet posting that started all this. In the header of the posting it was possible to find out not only the e-mail address from which it was sent but also the IP address of the computer from which it was sent. That IP was linked to an AOL account and from that the FBI subpoenaed AOL and they provided the dial-in logs...and found out what computer was assigned that IP address and from what telephone number the call was made. The AOL account was a compromised one...The phone call that used that account came from New Jersey and the FBI linked the phone number to a particular address. That is how they found the guy's computer...The data we provided them was the clue that led straight to the criminal. (David L. Smith pleaded guilty and was sentenced to 20 months in prison and $5,000 in fines.)
What was the motivation behind Melissa?
Graznov: There was no material gain. Back then, people didn't do it for money. They did it for mischief, for fame...Today there is huge money in computer crime...Back then, we had 200 times fewer pieces of malware than we have today.
Any comments on Conficker and Melissa and how far we've come?
Graznov: Conficker is a completely different type of thing. It's not a macro virus. It's an executable and a botnet, and it downloads lots of stuff on your computer. It's basically a network for sale. It can be rented out. It can be used for password stealing. Back in 1999 there wasn't such a thing as a business model for malware...Today, big money is involved in computer malware. You cannot even compare them.
by: EM
source : cnet
CNET News talked to Dmitry Graznov, a senior research architect at McAfee Avert Labs who was among the researchers who worked to fight the Melissa outbreak and track down the creator.
Q: How was Melissa discovered?
Graznov: Avert as a whole discovered it as did some of the competitors. It was submitted to us by customers as it started to spread around the world (on March 26, 1999).
What made Melissa different from previous viruses?
Graznov: It was the first mass-mailing virus, which used e-mail to spread on a large scale.
What harm did the virus do?
Graznov: In some cases the load on the e-mail servers in some organizations was so high that the servers were effectively shut down.
How many computers were affected and what did the virus do?
Graznov: Hundreds of thousands of computers were affected. That's a guess...Melissa infected other documents a user opened in Microsoft Word. It also connected to Outlook if it was running and selected 50 entries in the address book and e-mailed an infected document to those addresses...including mailing lists...As a result, the virus was sent not just to 50 people, but to thousands of people easily. We didn't have any firm numbers to go by, but we did have reports from customers saying their Exchange servers were overwhelmed.
How long did the outbreak last?
Graznov: Several days, but the infections continued to be registered for a long time after that. It was just a macro virus and we were well equipped to provide detection and removal for people's computers even then...The fact that it was so widespread in the world already meant it took a long time to remove the infections.
Security researcher Dmitry Graznov as he looked in 1999 when he was chasing down the creator of the Melissa virus for McAfee Avert Labs.
(Credit: Dmitry Graznov)
How did the virus writer get caught?
Graznov: I was running, actually still am, a project called Usenet Virus Patrol, which scans Usenet articles for viruses. The author of Melissa posted the virus to a newsgroup called "alt.sex." It was zipped up and sent as if it was a list of passwords to like 80-something different porno sites...It was just bait to entice people into downloading it and opening it. Once it was opened, it started e-mailing itself around. It was relatively easy to go back and find the exact Usenet posting that started all this. In the header of the posting it was possible to find out not only the e-mail address from which it was sent but also the IP address of the computer from which it was sent. That IP was linked to an AOL account and from that the FBI subpoenaed AOL and they provided the dial-in logs...and found out what computer was assigned that IP address and from what telephone number the call was made. The AOL account was a compromised one...The phone call that used that account came from New Jersey and the FBI linked the phone number to a particular address. That is how they found the guy's computer...The data we provided them was the clue that led straight to the criminal. (David L. Smith pleaded guilty and was sentenced to 20 months in prison and $5,000 in fines.)
What was the motivation behind Melissa?
Graznov: There was no material gain. Back then, people didn't do it for money. They did it for mischief, for fame...Today there is huge money in computer crime...Back then, we had 200 times fewer pieces of malware than we have today.
Any comments on Conficker and Melissa and how far we've come?
Graznov: Conficker is a completely different type of thing. It's not a macro virus. It's an executable and a botnet, and it downloads lots of stuff on your computer. It's basically a network for sale. It can be rented out. It can be used for password stealing. Back in 1999 there wasn't such a thing as a business model for malware...Today, big money is involved in computer malware. You cannot even compare them.
by: EM
source : cnet
Thursday, March 12, 2009
How to Turn off Automatic Updates in Windows XP
Lot of people are worried about their computer getting slow in performance as they have to update Windows and also other applications they installed in their Computer.Users are concerned about too much updates might slow down their computer.
If users can update their Computer when Critical vulnerabilities like Downadup\Conficker worms attacking through not patched or not updated systems,if users aware they can turn on automatic updates when they require ,we can safely turn off automatic updates.
To turn off automatic updates in windows XP
1.Start>settings>Control Panel>Security Center>Manage Security Settings for >Automatic Updates>Turn off automatic Updates>Apply and OK
by :
Wednesday, March 4, 2009
7 Step To Stop the virus that makes New Shortcut
by : Ardhi SuryadhiPIF Virus / Starter or a virus known as the shortcut to make the victim of sorts with lots of shortcuts made by the virus. Repotnya, if the means of the virus is not right even then he will come back, again and again.
Therefore, I see 7 sharpshooter from virus analyst Vaksincom MG Lat shortcut to stop the flood of virus that caused this:
1. Previous first turn off system restore process.
2. Turn off the process of Wscript file located in C: \ Windows \ System32, by using tools such as CProcess, HijackThis or can also use the Task Manager of Windows.
3. After the process of Wscript off, we had to delete-me-or rename the file so that's not to be used by the virus.
As a note, me-if we rename the file from Wscript.exe with the automatic, it will be copied again in the folder. Therefore, we must find where the file Wscript.exe the other, usually in C: \ Windows \ $ NtServicePackUninstall $, C: \ Windows \ ServicePackFiles \ i386.
No virus-like virus vbs other, we can change the Open With from the vbs file into Notepad, the virus berextensi this means is that mdb file Microsoft Access. So Wscript will run the file DATABASE.MDB as though he is a vbs file.
4. Delete the files in the parent C: \ Documents and Settings \ \ My Documents \ database.mdb, so that every time the computer will not run load the file. And do not forget we are also open msconfig, disable the run command.
5. Now we will delete the files Autorun.INF. Microsoft.INF and Thumb.db. How, click the START button, type CMD, moved to the drive to be cleaned, for example, drive C: \, then we should do is:
Type C: \ del Microsoft.inf / s, this command will delete all files in all microsoft.inf folder on drive C:. While the move would drive live just replaced the name drivenya example: D: \ del Microsoft.inf / s.
For the autorun.inf file, type C: \ autorun.inf del / s / ah / f, the command will delete the file autorun.inf (syntax / ah / f) is used because the file using the attrib RSHA, as well as to file Thumb . db also do the same.
6. For a delete-file file earlier than 4, we must find ways to search files with the extension. Lnk size 1 kb. In the 'More advanced options' option make sure that' Search system folders' and 'Search hidden files and folders' both are checked.
Please be careful, not all the shortcut files / LNK file size of 1 kb that is a virus, we can distinguish them from icons, size and type. To create a shortcut icon for the virus using icon 'folder', and the size of 1 kb bertipe 'shortcut'. While the correct folder should not have 'size' and the type is' File Folder '.
7. Fix the registry is modified by the virus. To speed up the process of repair registry copy the script below on the program 'notepad' and save it with the name 'Repair.inf'. Run the file in the following manner:
- Click right repair.inf
- Click Install
[Version]
Signature = "$ Chicago $"
Provider = Vaksincom Oyee
[DefaultInstall]
AddReg = UnhookRegKey
DelReg = del
[UnhookRegKey]
HKLM, Software \ CLASSES \ batfile \ shell \ open \ command ,,,"""% 1 ""% * "
HKLM, Software \ CLASSES \ comfile \ shell \ open \ command ,,,"""% 1 ""% * "
HKLM, Software \ CLASSES \ exefile \ shell \ open \ command ,,,"""% 1 ""% * "
HKLM, Software \ CLASSES \ piffile \ shell \ open \ command ,,,"""% 1 ""% * "
HKLM, Software \ CLASSES \ regfile \ shell \ open \ command,,, "regedit.exe"% 1 ""
HKLM, Software \ CLASSES \ scrfile \ shell \ open \ command ,,,"""% 1 ""% * "
HKLM, SOFTWARE \ Microsoft \ Windows NT \ CurrentVersion \ Winlogon, Shell, 0, "Explorer.exe"
HKLM, SYSTEM \ ControlSet001 \ Control \ SafeBoot, AlternateShell, 0, "cmd.exe"
HKLM, SYSTEM \ ControlSet002 \ Control \ SafeBoot, AlternateShell, 0, "cmd.exe"
[del]
HKLM, SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Run, Winupdate
HKCU, SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Run, explorer (ash / fyk)
source : detikinet.com
Other related articles :
- Prevent the virus from active autorun.inf with USB Firewall
- Beware, virus attacks' Hopeless' in First Year
- 10 Tips for Securing Computer When Vacation
- Tips for Reducing Risks are Computer Virus
- 7 Step to eradicate virus' K0pL4xZ '
Saturday, February 28, 2009
Tips for Overcoming Golden Ghost Virus
End - the end of this internet world by the emergence of local dikejutkan latest virus variants, the golden ghost.
For you are infected with this virus should be careful - careful as it will change the default Internet browser page to explore your site www.pl * YB * y.com (censor so safe:))
When this virus is grown locally with very rapidly. The virus not only local now only create duplicate files, menginfeksi data (ms office) and hide the file. But it is also menginfeksi executable file (exe). And distribution not only through flash, but is capable menginfeksi via email, can even chat through the media such as IRC and so on.
Golden Ghost virus created by using Visual Basic and compressed using UPX. This virus has the size of 1312 mb and using Windows media player icon to trick users.
There this feature - if you characterize the virus infected golden ghost:
1. show error message "16 bit MS-DOS subsystem" when the computer switched on and also appears every few minutes.
2. Change the name of the owner to "GoldenGhost"
3. Change the owner of the organization to "GoldenGost.Inc"
4. When booting the windows menu to appear "GoldenGhost Was Here"
5. Internet explorer home page changes to www.pl * YB * y.com
6. When the menu appears podići GoldenGhost was here and if selected the computer will restart.
7. Each time a user copy and paste the contents of text file, then the text will change to desahan "oohhh ... aughhhh ... yessss .. babbby ...!"
8. The virus will attempt to delete all files berekxtensi *. mov, *. wmv, *. 3gp, *. avi, *. mpg, *. mpeg in the flash disk.
The spread of the virus is classified as advanced as it is able to spread through IRC chat and media are trying to join to a number of channels such as Jakarta, Medan, malang, Bandung, Yogyakarta, Solo, Semarang with first connect to a server as follows:
punch.va.us.dal.net, rumble.fl.us.dal.net, mozilla.se.eu.dal.net, swiftco.wa.us.dal.net, haarlem.nl.eu.undernet.org, plasa.id.allnetwork.org.
once connected, will send the Golden Ghost pesan2 among others:
nick, free indonesian picture s * x, duble click url
nick, there's new info neh, marshanda, Agnes monica, Dian sastro, C i the interest rate b * gil, liat for the photos, double click url
indonesian artist nude, double click url
nick, indo artist magazine pl * YB * y, double click the URL
nick, like the artist magazine liat pl * y * YB indo, indonesian nick fr * rn * ep, double click url
ce indo nation, double click
so if you chat and find pesan2 is, it is not Rejeki, but disaster:)
but how to overcome if it is currently terlanjur "Rejeki" through the chat?
in fact update norman virus control can be overcome. even have a file that can improve the virus by diinjeksi golden ghost.
To get it, you can download here:
Download antivirus norman
Download Removal tool
source : various sources
For you are infected with this virus should be careful - careful as it will change the default Internet browser page to explore your site www.pl * YB * y.com (censor so safe:))
When this virus is grown locally with very rapidly. The virus not only local now only create duplicate files, menginfeksi data (ms office) and hide the file. But it is also menginfeksi executable file (exe). And distribution not only through flash, but is capable menginfeksi via email, can even chat through the media such as IRC and so on.
Golden Ghost virus created by using Visual Basic and compressed using UPX. This virus has the size of 1312 mb and using Windows media player icon to trick users.
There this feature - if you characterize the virus infected golden ghost:
1. show error message "16 bit MS-DOS subsystem" when the computer switched on and also appears every few minutes.
2. Change the name of the owner to "GoldenGhost"
3. Change the owner of the organization to "GoldenGost.Inc"
4. When booting the windows menu to appear "GoldenGhost Was Here"
5. Internet explorer home page changes to www.pl * YB * y.com
6. When the menu appears podići GoldenGhost was here and if selected the computer will restart.
7. Each time a user copy and paste the contents of text file, then the text will change to desahan "oohhh ... aughhhh ... yessss .. babbby ...!"
8. The virus will attempt to delete all files berekxtensi *. mov, *. wmv, *. 3gp, *. avi, *. mpg, *. mpeg in the flash disk.
The spread of the virus is classified as advanced as it is able to spread through IRC chat and media are trying to join to a number of channels such as Jakarta, Medan, malang, Bandung, Yogyakarta, Solo, Semarang with first connect to a server as follows:
punch.va.us.dal.net, rumble.fl.us.dal.net, mozilla.se.eu.dal.net, swiftco.wa.us.dal.net, haarlem.nl.eu.undernet.org, plasa.id.allnetwork.org.
once connected, will send the Golden Ghost pesan2 among others:
nick, free indonesian picture s * x, duble click url
nick, there's new info neh, marshanda, Agnes monica, Dian sastro, C i the interest rate b * gil, liat for the photos, double click url
indonesian artist nude, double click url
nick, indo artist magazine pl * YB * y, double click the URL
nick, like the artist magazine liat pl * y * YB indo, indonesian nick fr * rn * ep, double click url
ce indo nation, double click
so if you chat and find pesan2 is, it is not Rejeki, but disaster:)
but how to overcome if it is currently terlanjur "Rejeki" through the chat?
in fact update norman virus control can be overcome. even have a file that can improve the virus by diinjeksi golden ghost.
To get it, you can download here:
Download antivirus norman
Download Removal tool
Other related articles :
- Prevent the virus from active autorun.inf with USB Firewall
- Beware, virus attacks' Hopeless' in First Year
- 10 Tips for Securing Computer When Vacation
- Tips for Reducing Risks are Computer Virus
- 7 Step to eradicate virus' K0pL4xZ '
- 4 Step Virus Prevention Conficker
source : various sources
Wednesday, February 25, 2009
9 free antivirus programs for Windows
by Lee Mathews
Keeping your Windows computer virus-free doesn't have to cost you a lot of money. Heck, it doesn't need to cost you any money. There are plenty of good options available for those of you on the hunt for free antivirus software.
Wait - free? Don't companies like Norton make a good business out of selling antivirus protection? Why would someone give it away? Developers of free antivirus solutions like Avast and AVG are counting on a couple of things. First, that you'll like the free offering enough to want to buy an upgraded version of their product. Second, that if enough home users talk about how much they love it that their "computer guy" at work might want to use it on the company's systems.
The free options listed after the break offer the same kind of protection as the boxed software you can buy at the store.
Two things to keep in mind:
First, as with other free software, some of the developers ask for support in the form of a toolbar install. They're all optional, so make sure to un-tick the checkboxes during the install if you don't want the toolbar.
Second, a number of the developers offer a non-free version on the free version's download page via a service called TrialPay. The totally free version is normally on the left, the TrialPay offer on the right - make sure you're clicking the link you actually want.
Wait - free? Don't companies like Norton make a good business out of selling antivirus protection? Why would someone give it away? Developers of free antivirus solutions like Avast and AVG are counting on a couple of things. First, that you'll like the free offering enough to want to buy an upgraded version of their product. Second, that if enough home users talk about how much they love it that their "computer guy" at work might want to use it on the company's systems.
The free options listed after the break offer the same kind of protection as the boxed software you can buy at the store.
Two things to keep in mind:
First, as with other free software, some of the developers ask for support in the form of a toolbar install. They're all optional, so make sure to un-tick the checkboxes during the install if you don't want the toolbar.
Second, a number of the developers offer a non-free version on the free version's download page via a service called TrialPay. The totally free version is normally on the left, the TrialPay offer on the right - make sure you're clicking the link you actually want.
I see Avast's little blue sphere in a lot of system trays, and with good reason: it's one of the most recommended free Windows antivirus options. One nice thing about Avast is that the installer only installs the antivirus program – there's no toolbar or anything else to dodge. Definitions update automatically, scans can be scheduled, and the boot-time scan tool does a good job at uprooting even stubborn infections.
You do need to register for a product key, though Avast will never email you anything other than the confirmation message.
Get it from: Avast | FileHippo | Softpedia
AVG has been a popular free antivirus option for Windows users for a number of years. It provides solid protection against viruses and other malware, and there's no registration required. Virus definition updates are automatic, and scheduled scanning is supported. Version 8 ships with the optional AVG Security Toolbar, which may be a good idea for some users. It provides security ratings for known websites and provides a little added protection in your browser – a place some users desperately need it.
Be sure to watch for the toolbar install and opt out if you don't want it. Also pay attention on the download page: free link on the left, TrialPay on the right.
Get it from: Download.com | FileHippo | Softpedia
Avira's offering is third on the list alphabetically and that's where it falls popularity wise on Download.com, just behind AVG and Avast. It's rated highly for fast and accurate scanning, and is easy on system resources. AntiVir's simple interface and solid protection make it a good choice for novice users.
One bothersome aspect is the nag screen that appears periodically to remind you about Avira's paid product. Also, on Avira's download page look on the left side for the completely free link - the right side is a TrialPay offer.
Get it from: Avira | FileHippo | Softpedia
Another lesser-known (but solid) option is BitDefender. In addition to virus and malware defense, BitDefender also includes a privacy protection feature that monitors web traffic and outbound mail for possible breaches. Its scanning engine is fairly speedy and detection rates are on par with more well-known software.
The download page is a bit like Avira's, so make sure you don't use the TrialPay offer on the right unless you really want to. The free download is on the left side.
Get it from: BitDefender | FileHippo | Softpedia
Unlike other programs on this list, Clam is not a realtime virus scanner, meaning it won't notify you the instant an infected file gets saved to your hard drive. Because of this shortcoming, ClamWin is probably not a good choice for novice users. It does, however, support scheduled scans and integrates with Windows Explorer so you can manually right-click and scan files. It also integrates with Microsoft Outlook and can remove infected attachments automatically.
You can get on-access protection with ClamWin by integrating it with WinPatrol or Spyware Terminator.
Get it from: ClamWin | FileHippo | Snapfiles
Comodo's free antivirus application comes as part of their Internet Security suite. Comodo's firewall software has always been very well-respected, but you can choose to only install the antivirus during the install if you prefer. It's a solid performer, with good scanning speed and detection rates, and few false positives.
Like AVG, Comodo packages a toolbar (called safe surf). It'll also prompt you to change your homepage, so just make sure to uncheck the boxes if you want to opt out.
Get it from: Comodo | Download.com | Softpedia
PC Tools are the same people that produce Spyware Doctor, one of the most popular anti-spyware applications around (though not my personal choice). Its interface is simple and easy to understand for novice users, though advanced users are likely to be frustrated by the lack of more sophisticated options that are available in other free programs. Scheduled scanning is supported, as are automatic definition updates.
Get it from: PC Tools
Even with the regal lion face logo, Rising hasn't garnered a lot of respect yet. Still, those who do use it seem very pleased with the protection it provides and also report that it's easy on system resources. A complete scan with Rising is a bit more sluggish than with more popular options, but most of you probably run scheduled scans when you're AFK anyway – so it's not a big downside.
It's regarded as a good choice for non-technical users.
Get it from: Rising AV | Snapfiles | Softpedia
Spyware Terminator isn't an antivirus program on its own, but you can choose to integrate ClamWin during the setup process. Unlike installing Clam on its own, pairing the two applications provides realtime virus protection. It's regarded as a very good anti-spyware application, though reviews are mixed on its ability to handle antivirus duties.
As with AVG and Comodo, a toolbar install will be offered during the setup process.
Get it from: Spyware Terminator | FileHippo | Softpedia
If you're not sold on the idea of free antivirus and are looking to test drive some paid options, there are plenty available for download. Just about every major developer of antivirus software offers at least a 30 day trial of their product. Here are three solid choices you can take for a test drive.
NOD32 is the choice of a number of Download Squad crew members. It's very well-respected by system admins and technicians and one of the best programs available to protect your PC from infection. Downloading the current version gets you 30 days to try it out.
If you're so inclined, you can download beta versions or release candidates as well - and you'll get up to 6 months of free protection.
Another option held in high regard by experienced users, the Kaspersky scanning engine is licensed by a number of other companies that provide antivirus software. Trial versions last 30 days.
Trend has been a truster choice in coporate environments for a long time, though their PC Cillin software for consumers isn't as popular as some other tites. It's still a solid choice and provides good protection. Again, 30 days to try it out.
Other related articles :
- Prevent the virus from active autorun.inf with USB Firewall
- Beware, virus attacks' Hopeless' in First Year
- 10 Tips for Securing Computer When Vacation
- Tips for Reducing Risks are Computer Virus
- 7 Step to eradicate virus' K0pL4xZ '
7 Steps for deracinate Virus: ' Conficker '
Virus' Conficker.DV 'using the distribution method that is different from preceding. With canggihnya, the virus tried to access the network using a slit windows' Default Share '(ADMIN $ \ system32) with the administrator password.
In addition 'Conficker.DV' also create a file on removable media such as flash, hard drive and card reader to save the file hidden on the root drive.
While the action the same as preceding, that is trying mengexploitasi MS08-067 security cleft or Windows, or Windows Server Service SVCHOST.exe. Many users are not infected because of the Automatic Updates feature and do not patch Windows MS08-067.
If you are like this, see step 7 short of the virus analyst Adi Saputra Vaksincom to eradicate the virus' Conficker.DV 'received detikINET, Wednesday (28/1/2009):
1. Disconnect the computer that will be cleared from the network / internet.
2. Turn off system restore (Windows XP / Vista).
3. Turn off the virus is active in the services. Use the removal tool from Norman to clean the virus is active. If you do not have, can be downloaded at the site norman.
4. Delete the service svchost.exe fake virus on ditanamkan registry. You can search manually in the registry.
5. Delete Task Schedule is created by the virus. (C: \ WINDOWS \ Tasks)
6. Remove the registry string is created by the virus. To facilitate the registry can use the script below:
[Version]
Signature = "$ Chicago $"
Provider = Vaksincom Oyee
[DefaultInstall]
AddReg = UnhookRegKey
DelReg = del
[UnhookRegKey]
HKCU, Software \ Microsoft \ Windows \ CurrentVersion \ Explorer \ Advanced,
Hidden, 0x00000001, 1
HKCU, Software \ Microsoft \ Windows \ CurrentVersion \ Explorer \ Advanced,
SuperHidden, 0x00000001, 1
HKLM,
SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Explorer \ Advanced \ Folder \ Hidden \ SHOWALL,
CheckedValue, 0x00000001, 1
HKLM, SYSTEM \ CurrentControlSet \ Services \ Bits, Start, 0x00000002, 2
HKLM, SYSTEM \ CurrentControlSet \ Services \ ERSvc, Start, 0x00000002, 2
HKLM, SYSTEM \ CurrentControlSet \ Services \ wscsvc, Start, 0x00000002, 2
HKLM, SYSTEM \ CurrentControlSet \ Services \ wuauserv, Start, 0x00000002, 2
[del]
HKCU, Software \ Microsoft \ Windows \ CurrentVersion \ applets, dl
HKCU, Software \ Microsoft \ Windows \ CurrentVersion \ applets, ds
HKLM, SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ applets, dl
HKLM, SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ applets, ds
HKLM, SYSTEM \ CurrentControlSet \ Services \ TCPIP \ Parameters, TcpNumConnections
Use notepad, then save with the name 'repair.inf', then 'Save As Type' to 'All Files' so that the error does not occur. Repair.inf run with the right click, then select install.
Meanwhile, for the active file on startup, you can mendisable through 'msconfig' or can be manually mendelete on the string: 'HKLM, SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Run'
7. For cleaning the virus W32/Conficker.DV optimally and prevent re-infection, you should use and update anti-virus that is able to detect this virus with both your computer and the patch with the official patch from Microsoft to prevent re-infection.
source : detikinet.com
In addition 'Conficker.DV' also create a file on removable media such as flash, hard drive and card reader to save the file hidden on the root drive.
While the action the same as preceding, that is trying mengexploitasi MS08-067 security cleft or Windows, or Windows Server Service SVCHOST.exe. Many users are not infected because of the Automatic Updates feature and do not patch Windows MS08-067.
If you are like this, see step 7 short of the virus analyst Adi Saputra Vaksincom to eradicate the virus' Conficker.DV 'received detikINET, Wednesday (28/1/2009):
1. Disconnect the computer that will be cleared from the network / internet.
2. Turn off system restore (Windows XP / Vista).
3. Turn off the virus is active in the services. Use the removal tool from Norman to clean the virus is active. If you do not have, can be downloaded at the site norman.
4. Delete the service svchost.exe fake virus on ditanamkan registry. You can search manually in the registry.
5. Delete Task Schedule is created by the virus. (C: \ WINDOWS \ Tasks)
6. Remove the registry string is created by the virus. To facilitate the registry can use the script below:
[Version]
Signature = "$ Chicago $"
Provider = Vaksincom Oyee
[DefaultInstall]
AddReg = UnhookRegKey
DelReg = del
[UnhookRegKey]
HKCU, Software \ Microsoft \ Windows \ CurrentVersion \ Explorer \ Advanced,
Hidden, 0x00000001, 1
HKCU, Software \ Microsoft \ Windows \ CurrentVersion \ Explorer \ Advanced,
SuperHidden, 0x00000001, 1
HKLM,
SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Explorer \ Advanced \ Folder \ Hidden \ SHOWALL,
CheckedValue, 0x00000001, 1
HKLM, SYSTEM \ CurrentControlSet \ Services \ Bits, Start, 0x00000002, 2
HKLM, SYSTEM \ CurrentControlSet \ Services \ ERSvc, Start, 0x00000002, 2
HKLM, SYSTEM \ CurrentControlSet \ Services \ wscsvc, Start, 0x00000002, 2
HKLM, SYSTEM \ CurrentControlSet \ Services \ wuauserv, Start, 0x00000002, 2
[del]
HKCU, Software \ Microsoft \ Windows \ CurrentVersion \ applets, dl
HKCU, Software \ Microsoft \ Windows \ CurrentVersion \ applets, ds
HKLM, SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ applets, dl
HKLM, SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ applets, ds
HKLM, SYSTEM \ CurrentControlSet \ Services \ TCPIP \ Parameters, TcpNumConnections
Use notepad, then save with the name 'repair.inf', then 'Save As Type' to 'All Files' so that the error does not occur. Repair.inf run with the right click, then select install.
Meanwhile, for the active file on startup, you can mendisable through 'msconfig' or can be manually mendelete on the string: 'HKLM, SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Run'
7. For cleaning the virus W32/Conficker.DV optimally and prevent re-infection, you should use and update anti-virus that is able to detect this virus with both your computer and the patch with the official patch from Microsoft to prevent re-infection.
Other related articles :
- Prevent the virus from active autorun.inf with USB Firewall
- Beware, virus attacks' Hopeless' in First Year
- 10 Tips for Securing Computer When Vacation
- Tips for Reducing Risks are Computer Virus
- 7 Step to eradicate virus' K0pL4xZ '
- 4 Step Virus Prevention Conficker
source : detikinet.com
Wednesday, January 21, 2009
Tools to combat virus
You have a bad experience with the virus? . Some of this equipment may be able to help.
Based on experience, this tool-tool that when combined can be very effective to combat the virus. Tools are:
Based on experience, this tool-tool that when combined can be very effective to combat the virus. Tools are:
Other related articles :
- Prevent the virus from active autorun.inf with USB Firewall
- Beware, virus attacks' Hopeless' in First Year
- 10 Tips for Securing Computer When Vacation
- Tips for Reducing Risks are Computer Virus
- 7 Step to eradicate virus' K0pL4xZ '
- 4 Step Virus Prevention Conficker
- Cyberhawk. Defender. Very powerful prevetif for action against viruses and malware. Once installed, restart your computer directly, then you will know the results. You can download here.
- HijackThis. Scanning Registry. Can be used as a reference to delete registry viruses. You can download here.
- ProcessExplorer. Viewing and kill the process that is not desired. Some of the virus can not be directly handled by the killer machine.. so before the killer machine, identify and kill the process virus first. You can download here.
- TuneUp Utilities (Trial). Repairing and registry scanning. For repairing can directly select one click maintenance. Usually the virus mendisable regedit. You can use the Registry Editor TuneUp registry to search for the virus. unfortunately that this is free. You can download here.
- The Killer Machine. Virus removal n take back common registry values. Killer machine can restore conditions such as back mengenable regedit, search, run, and it will be done after the restart. If you do not have Cyberhawk, install first cyberhawk because this is a powerful combination. Cyberhawk can detect the movement of the virus although there is no antivirus that can address them. You can download here (version 3). Version 4, what is this: Version 4 Fixed,
Translate by : Me
SMADAV - powerful anti-virus made indonesian
The problem is a virus, here is the solution.
Fell ill a computer virus? USB Flash exposed to the virus? Brontok? Use Antivirus indonesian children made, powerful and fast. Download for free, so download it now!
To Download Clik Here
by : anang
Fell ill a computer virus? USB Flash exposed to the virus? Brontok? Use Antivirus indonesian children made, powerful and fast. Download for free, so download it now!
Other related articles :
- Prevent the virus from active autorun.inf with USB Firewall
- Beware, virus attacks' Hopeless' in First Year
- 10 Tips for Securing Computer When Vacation
- Tips for Reducing Risks are Computer Virus
- 7 Step to eradicate virus' K0pL4xZ '
- 4 Step Virus Prevention Conficker
To Download Clik Here
by : anang
Removing the virus HTML.Redlof.A file Desktop.ini & Folder.htt
Redlof is a polymorphic virus that is able to hang himself every email sent from a computer virus that has infected this not through the attachment included. So this virus does not need to disguise himself as an attachment to spread. The virus, also known as HTML.Redlof.A is very possible. Although it does not cause loss of data and information, but it will disrupt the performance of the computer.
The spread of the virus is done through the script. The script copies the files into the berekstensi. Htm,. Html,. Vbs,. Asp,. Htt,. Jsp on the hard drive. When someone execution of the file, the script will automatically copy the script into a file that is other. And so on. This process will continue to take place if the files over executed.
Vbs / Redlof.A @ m run through the messages that have been affected by this virus, through vulnerbility security on the Internet Exlorer regular known as Microsoft VM ActiveX Control Vulnerability. More information about this case please open Microsoft site: http://www.microsoft.com/technet/security/bulletin/ms00-075.asp
Menginfeksi this virus can file a berextensi as "htm", "html", "asp", "php", "jsp", "htt" or "vbs".
Redlof also drops several files menginfeksi such as:
\ Program Files \ Common Files \ Microsoft Shared \ Stationery \ blank.html
\ Windows \ System \ Kernel32.dll
\ Windows \ web \ kjwall.gif
\ Windows \ system32 \ desktop.ini
"blank.html" is used to replace the default stationari in Outlook and Outlook Express through the system registry, which cause each message sent by this computer will contain the virus load.
"Kernel32.dll" is used to make the system registry to save the virus to run the operating system to restart:
HKLM \ Software \ Microsoft \ Windows \ CurrentVersion \ Run \ Kernel32
So if the above have been infected file2, automatically and quickly the virus spread and menginfeksi on the computer and other computers.
Download Removel tool
The spread of the virus is done through the script. The script copies the files into the berekstensi. Htm,. Html,. Vbs,. Asp,. Htt,. Jsp on the hard drive. When someone execution of the file, the script will automatically copy the script into a file that is other. And so on. This process will continue to take place if the files over executed.
Vbs / Redlof.A @ m run through the messages that have been affected by this virus, through vulnerbility security on the Internet Exlorer regular known as Microsoft VM ActiveX Control Vulnerability. More information about this case please open Microsoft site: http://www.microsoft.com/technet/security/bulletin/ms00-075.asp
Menginfeksi this virus can file a berextensi as "htm", "html", "asp", "php", "jsp", "htt" or "vbs".
Redlof also drops several files menginfeksi such as:
\ Program Files \ Common Files \ Microsoft Shared \ Stationery \ blank.html
\ Windows \ System \ Kernel32.dll
\ Windows \ web \ kjwall.gif
\ Windows \ system32 \ desktop.ini
"blank.html" is used to replace the default stationari in Outlook and Outlook Express through the system registry, which cause each message sent by this computer will contain the virus load.
"Kernel32.dll" is used to make the system registry to save the virus to run the operating system to restart:
HKLM \ Software \ Microsoft \ Windows \ CurrentVersion \ Run \ Kernel32
So if the above have been infected file2, automatically and quickly the virus spread and menginfeksi on the computer and other computers.
Download Removel tool
http://www.gdata.pl/kmdownload/download.php?op=getit&id=61
http://www.softpedia.com/get/Antivirus/Redlof-Remover.shtml
Other related articles :
- Prevent the virus from active autorun.inf with USB Firewall
- Beware, virus attacks' Hopeless' in First Year
- 10 Tips for Securing Computer When Vacation
- Tips for Reducing Risks are Computer Virus
- 7 Step to eradicate virus' K0pL4xZ '
- 4 Step Virus Prevention Conficker
source : pcguru.okihelfiska.ne
Translate by : Me
