On a very serious note

[Ross]

People with April first about to come, I do hope you all, that are running Windows operating systems, have all of your Windows critical updates and Antivirus programs up to date.

Conflicker C, a very nasty virus, is supposed to sprout on April 1st and all indications are that this is very real. It's after your personal information and takes over your computer to infect others. Please take ths threat seriously.

 

[geebee]

Are we sure this is not just the "most excellent" April Fool's joke since the spaghetti trees?

 

[Ross]

http://mtc.sri.com/Conficker/addendumC/index.html

http://www.tomsguide.com/us/PC-Worm-Downadup-Conflicter,news-3317.html

 

[Eva]

Ross,

I heard that all the internet services will be shut down to avoid that virus from entering any computer that day

 

[Tbone]

I have to get ahold of my jump drive to get my updates on the home computer. Thnks for passing this on, I heard about this a couple of days ago but forgot

 

[Ross]

Some of your machines may already be infected and you may not know it!

This is in no way and Aprils fools joke. This is a very real threat.

http://msmvps.com/blogs/harrywaldro...nt-ms08-067-attacks-to-unpatched-systems.aspx

 

[Ross]

Description
Win32/Conficker.C is a worm capable of blocking security related websites, terminating system security services and downloading component files using time-based generated URLs.

Method of Infection

When executed, Win32/Conficker.C drops a copy of itself using a random filename in the %System% directory. It may also drop copies of itself in the following directories:

%Program Files%\Windows NT
%Program Files%\Windows Media Player
%Program Files%\Internet Explorer
%Program Files%\Movie Maker

For these and other dropped files, Win32/Conficker.C:

* Sets Read Only, Hidden and System file attributes
* Generates a file creation/access time-stamp based on that of "kernel32.dll"
* Creates access control entries
* Exclusively locks the file, thus restricting access and privileges

Note: %System% and %Program Files% are variable locations. The malware determines the locations of these folders by querying the operating system. The default installation location for the System directory for Windows 2000 and NT is C:\Winnt\System32; for 95,98 and ME is C:\Windows\System; for XP and Vista is C:\Windows\System32. A typical location for the Program Files folder would be C:\Program Files.

In order to automatically execute at each startup, it adds the registry entry below:

HKCU\Software\Microsoft\Windows\CurrentVersion\Run\<random string> = "rundll32.exe <worm executable>, <random string>"

Conficker also registers a service with a random name created by combining a word from this list:

App
Audio
DM
ER
Event
help
Ias
Ir
Lanman
Net
Ntms
Ras
Remote
Sec
SR
Tapi
Trk
W32
win
Wmdm
Wmi
wsc
wuau
xml

with another word from this list:

access
agent
auto
logon
man
mgmt
mon
prov
serv
Server
Service
Srv
srv
svc
Svc
System
Time

The worm also derives a display name for the service by combining two words from the list below:

Audit
Backup
Boot
Browser
Center
Component
Config
Control
Discovery
Driver
Framework
Hardware
Helper
Image
Installer
Logon
Machine
Management
Manager
Microsoft
Monitor
Network
Notify
Policy
Power
Security
Shell
Storage
Support
System
Task
Time
Trusted
Universal
Update
Windows

For example, the worm may register a service with these registry entries:

HKLM\SYSTEM\CurrentControlSet\Services\IrSvc\DisplayName = "Component Task"
HKLM\SYSTEM\CurrentControlSet\Services\IrSvc\Type = 00000020
HKLM\SYSTEM\CurrentControlSet\Services\IrSvc\Start = 00000002
HKLM\SYSTEM\CurrentControlSet\Services\IrSvc\ErrorControl = 00000000
HKLM\SYSTEM\CurrentControlSet\Services\IrSvc\ImagePath = "%Root%\system32\svchost.exe -k netsvcs"
HKLM\SYSTEM\CurrentControlSet\Services\IrSvc\ObjectName = "LocalSystem"
HKLM\SYSTEM\CurrentControlSet\Services\IrSvc\Description = "<randomly copied from an existing service with a Startup Type of 2 >"
HKLM\SYSTEM\CurrentControlSet\Services\IrSvc\Parameters\ServiceDll = "%System%\<worm executable >"


Note: %Root% is a variable location. The malware determines the location of the current root drive by querying the operating system. A typical location for the root drive would be C:\.

Additionally, Win32/Conficker.C checks for and tries to inject code into any processes executed with the commandline parameters "svchost.exe -k NetworkService".

Back to top
Payload
Modifies Registry / Lowers Security Settings

Win32/Conficker.C deletes the following registry entry to deactivate Windows Security Center notifications:

HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\ShellServiceObjects\{FD6905CE-952F-41F1-9A6F-135D9C6622CC}

It deletes the registry entry below to prevent the operating system from starting in Safe Mode:

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot

Additionally, Win32/Conficker.C deletes the below registry entry to prevent "Windows Defender" from executing on system start:

HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Windows Defender

Deletes Restore Points

Conficker resets all system restore points and deletes any saved system restore points on the affected system.

Disables Services

Win32/Conficker.C looks for and disables the following services if running:

wscsvc - Security Center
WinDefend – Windows Defender (available in Vista)
wuauserv - Automatic Updates
BITS - Background Intelligent Transfer Service
ERSvc - Error Reporting Service
WerSvc - Windows Error Reporting Service (available in Vista)


Terminates Processes

Win32/Conficker.C terminates the following security-related processes in an attempt to prevent its removal from the system:

autoruns
avenger
confick
downad
filemon
gmer
hotfix
kb890
kb958
kido
klwk
mbsa.
mrt.
mrtstub
ms08-06
procexp
procmon
regmon
scct_
sysclean
tcpview
unlocker
wireshark

Blocks Websites

Win32/Conficker.C hooks the following APIs to monitor and restrict access to security websites:

Query_Main
DnsQuery_W
DnsQuery_UTF8
DnsQuery_A
sendto

In its attempt to prevent access to security-related sites for information, help or software updates, the worm attempts to block running applications from accessing URLs containing any of the following strings:

avg.
avp.
bit9.
ca.
cert.
gmer.
kav.
llnw.
llnwd.
msdn.
msft.
nai.
sans.
vet.
agnitum
ahnlab
anti-
antivir
arcabit
avast
avgate
avira
bothunter
castlecops
ccollomb
centralcommand
clamav
comodo
computerassociates
conficker
cpsecure
cyber-ta
db networkassociates
defender
drweb
dslreports
emsisoft
esafe
eset
etrust
ewido
f-prot
f-secure
fortinet
free-av
freeav
gdata
grisoft
hackerwatch
hacksoft
hauri
ikarus
jotti
k7computing
kaspersky
malware
mcafee
microsoft
mirage
msftncsi
msmvps
mtc.sri
nod32
norman
norton
onecare
panda
pctools
prevx
ptsecurity
quickheal
removal
rising
rootkit
safety.live
securecomputing
secureworks
sophos
spamhaus
spyware
sunbelt
symantec
technet
threat
threatexpert
trendmicro
trojan
virscan
virus
wilderssecurity
windowsupdate

Downloads and Executes Arbitrary Files

If the current system date is on or after 1 April 2009, the worm attempts to access pre-computed domain names to either download an updated copy of itself or download other malware. Below is a list of URL extensions used for pre-computed/generated URLs:

vn
vc
us
tw
to
tn
tl
tj
tc
su
sk
sh
sg
sc
ru
ro
ps
pl
pk
pe
no
nl
nf
my
mw
mu
ms
mn
me
md
ly
lv
lu
li
lc
la
kz
kn
is
ir
in
im
ie
hu
ht
hn
hk
gy
gs
gr
gd
fr
fm
es
ec
dm
dk
dj
cz
cx
com.ve
com.uy
com.ua
com.tw
com.tt
com.tr
com.sv
com.py
com.pt
com.pr
com.pe
com.pa
com.ni
com.ng
com.mx
com.mt
com.lc
com.ki
com.jm
com.hn
com.gt
com.gl
com.gh
com.fj
com.do
com.co
com.bs
com.br
com.bo
com.ar
com.ai
com.ag
co.za
co.vi
co.uk
co.ug
co.nz
co.kr
co.ke
co.il
co.id
co.cr
cn
cl
ch
cd
ca
bz
bo
be
at
as
am
ag
ae
ac


Additional Information

So that only one copy of itself runs at a time, Conficker creates a mutex in the format "Global\%u-%u", where "%u" is a decimal number.

The worm accesses the following websites to test Internet connectivity:

ask.com
baidu.com
facebook.com
google.com
imageshack.us
rapidshare.com
w3.org
yahoo.com

 

[hensylee]

according to my kindle news this morning it's been around for awhile but gets updated constantly. MS is offering a $250,000 reward to find the originator(s) of this awful thing.

 

[Ross]

according to my kindle news this morning it's been around for awhile but gets updated constantly. MS is offering a $250,000 reward to find the originator(s) of this awful thing.

The anties gone up for the writer of this thing. There is now a whole posse after him.

 

[Duff Man]

I use linux. Viruses don't scare me

25 reasons to use Ubuntu Linux: http://anuragbansal.wordpress.com/2008/04/07/25-reasons-to-use-ubuntu-instead-of-windows/

 

[Ross]

It's all about open source...........

This is just for you Duffman:

http://ubergeek.tv/article.php?pid=54

 

[khawkk]

some downloads for conflicker

some downloads for conflicker

certainly just trying to help, the wife works on puters too.

Lots of free safe tools to download and stash for disinfection. These cos. do not spam you.

Symantec

http://www.symantec.com/norton/theme.jsp?themeid=conficker_worm

three downloads midpage if you have Symantec/Norton




Panda

http://www.pandasecurity.com/usa/homeusers/downloads/usbvaccine/

M$ Malicious Software Removal Tool

http://www.microsoft.com/security/malwareremove/default.mspx

lots more out there, you don't have to buy and are safe.


BitDefender
single removal on PC or network versions

http://www.bdtools.net/

 

[hensylee]

when I turned on my computer this morning, I got a msg from McAfee that I needed some fixes and should reinstall my program - didn't like that so told mcAfee to 'fix'. It was already doing it so I don't know if there was somebody about to grab me with that message about reinstall or not, but I didn't reinstall and checked McAfee after the fix and all my stuff is safeguarded now. this thing can start before/after April 1st so just start being careful right now. Also it's servers and large companies these folks are mostly after and their aim is monetary. well, duh, course it is.

 

[Nancy]

Here's a good one-- I went to Google to get more information on this virus, and the site marked CNN which was one of the first ones, attempted to install a Trojan on my computer. Norton caught it. Must have been a fake site.

So be very careful with this virus.

 

[hensylee]

I got some info that said if you try to get info on the worm, you might infect your own computer so I am just waiting for info from elsewhere. may shut everything off on Apr 1 just iin case.

 

[Ross]

when I turned on my computer this morning, I got a msg from McAfee that I needed some fixes and should reinstall my program - didn't like that so told mcAfee to 'fix'. It was already doing it so I don't know if there was somebody about to grab me with that message about reinstall or not, but I didn't reinstall and checked McAfee after the fix and all my stuff is safeguarded now. this thing can start before/after April 1st so just start being careful right now. Also it's servers and large companies these folks are mostly after and their aim is monetary. well, duh, course it is.

If you get any update notices, go directly to your antiviruses site and don't download it from a pop up window.

 

[Ross]

Here's a good one-- I went to Google to get more information on this virus, and the site marked CNN which was one of the first ones, attempted to install a Trojan on my computer. Norton caught it. Must have been a fake site.

So be very careful with this virus.

Yeah I just got the same thing. Google again, look at the address for that site and add it to your restricted sites zone in internet options. Problem is, new addresses are coming up all the time for that darn thing.

 

[Ross]

I got some info that said if you try to get info on the worm, you might infect your own computer so I am just waiting for info from elsewhere. may shut everything off on Apr 1 just iin case.

The problem is, some people are already infected and don't even know it as of yet. It's going to be busniess as usual for me. I've taken all the precautions I possibly can. All critical windows updates done, antivirus is constantly updating itself and hope for the best.

 

[Ross]

Repair tools should one find themselves infected and still can get on the internet:

http://www.confickerworkinggroup.org/wiki/pmwiki.php?n=ANY.RepairTools

 

[Bina]

I'm SKEERED......