Downadup worm infects about 15 million computers- are you protected?

[jpf]

Computer worm spreading like wildfire- are you protected?

http://www.walletpop.com/blog/2009/01/17/computer-worm-spreading-like-wildfire-are-you-protected/
Tom Barlow
Jan 17th 2009 at 1:30PM
Text SizeAAA

Filed under: Technology

Are you a Windows Vista, XP or Windows Server 2003 user that has lost patience with updating your system every time Microsoft tells you to? Then pay attention; you might be vulnerable to the Downadup worm, which is spreading like wildfire among unprotected PCs. According to Computerworld, 9 million computers have been infected in the last two weeks alone.

The worm exploits a vulnerability in Windows that was recognized by Microsoft in October of 2008. The company issued an update at that time to address this problem, but apparently millions of users didn't get the message, or chose to ignore it.

The worm allows the infected computer to be hijacked and used in nefarious ways such harvesting personal info or contributing to denial of service attacks.

Symantec, the company behind Norton Anti-virus, deems this "one of the most prolific worms we've seen in years", which has "an extremely large infection base that could do a lot of damage." To safeguard yourself, make sure you've installed the update http://www.microsoft.com/protect/computer/updates/bulletins/200901.mspx, and run Microsoft's Malicious Software Removal Tool.

[PikachuManZzZ]

Question: What's the vector? E-mail attachments? Malicious websites? Or is it just going after open ports (a la blaster)?

[Crixx_Creww]

http://www.symantec.com/norton/security_response/writeup.jsp?docid=2009-010717-4209-99

[jpf]

not email or the web, but through the Windows flaw/bug (probably via some port?), through network shares AND also USB drives-3 different ways!

[Nephilim]

Are you a Windows Vista, XP or Windows Server 2003 user that has lost patience with updating your system every time Microsoft tells you to? Then pay attention; you might be vulnerable to the Downadup worm, which is spreading like wildfire among unprotected PCs. According to Computerworld, 9 million computers have been infected in the last two weeks alone.

so can i assume server 2008 doesn't have said bug?

[jpf]

vista & server 2008 is also affected but the severity is rated 'important' instead of critical

http://www.microsoft.com/technet/security/Bulletin/MS08-067.mspx

[jpf]

estimates are now at 15 million by some websites

[kiya]

darn... so how DO i protect my pc?

[Cross]

This worm was NASTY

[Bone]

whats the best fire wall program 2 used if your using windows vista?

[Netizen1]

Well we got hit HARD in work... First noticed something was amiss when I got over 10 calls in one day to unlock users' accounts. Same person actually called me 3 times another day. NetWrix Account Lockout Examiner helped track down the root cause.

Bloody AV server went offline at the wrong time of the year!!! Grrrr!

So we had this massive exercise, got the Helpdesk out of their chairs and rolled out a new AV client software, updates et al.

Still infected though, have to visit the other sites to see if all's well there...

I see all the important links were posted already.

We had to use a combination attack;
Install Windows Patch (here)
Run Symantec removal tool (here)
Update Definitions
Install upgraded AV client



So far we're just over 55% coverage, hoping to knock off the rest by the end of Thursday, then it's off to Tobago to patch them up.

Nasty lil bit of code indeed.

[Crixx_Creww]

reminds me of when sasser was rampant
that was annoying as hell
also required walking to every machine an rinsing out wit detol

when yu go tobago
doh eat de royal castle in de airport
that laid me out for a few days when i got back home

[jpf]

you may be infected with the Conficker worm (or another worm) if

-your computer slows down
-displays fake virus warnings
-you can't enable 'show hidden files' in Tools/Folder Options/View
-you type 'attrib' at the command prompt in the root folder of the hard drive (c:\) or your flash drive and see a autorun.inf file along with other strange executable files (.cmd or .com files)
-on a domain accounts are locked out or the network is congested

-or according to microsoft:-
    * Account lockout policies are being tripped.
    * Automatic Updates, Background Intelligent Transfer Service (BITS), Windows Defender, and Error Reporting Services are disabled.
    * Domain controllers respond slowly to client requests.
    * The network is congested.
    * Various security-related Web sites cannot be accessed.

if you're infected (or just in case!)

http://support.microsoft.com/kb/962007

http://onecare.live.com/site/en-Us/virusenc/virusencinfo.htm?VirusName=Worm:Win32/Conficker.B

http://www.microsoft.com/security/portal/Entry.aspx?Name=Win32/Conficker

[roodie]

Is this the same virus that copies itself via network shares and flash drives? We found a quick way to deal with this as people were getting re-infected, open the autorun.inf file and clear the contents (Its a script) then make the file readonly and leave it there. Leaving it there kinda helps so the next time the pc in question gets hit, it can't copy the file.