WTF? Downandup/Conficker worm

hey · 01-21-2009, 06:22 PM

ITS A BITCH !!!!

udging from the complaints and questions filling my inbox, Windows security looks like it's already on track for its worst year this decade. The latest attack is a worm called Downandup, Downadup, Kido!, or Conficker (all the same thing), and it primarily seems to be being delivered via infected USB drives.

How's it work? By tricking you into running the virus by modifying the way "autorun" works when you plug in a drive. Look closely at the screenshot above and you'll see two entries for "Open folder to view files." The one at the top is a phony entry that actually installs the virus on your machine... but of course it's the default selection that pops up when you plug in a drive. Once installed, the virus spreads like crazy via a separate flaw in Windows networking system (now patched, so be sure to run Windows Update if you haven't lately) and can quickly infect a whole office. F-Secure has more analysis on the clever way it tricks you into installing the malware yourself.

How bad has it gotten? Estimates range from 3.5 million infected in the first four days after it bean spreading to 9 million impacted... and gettng worse. By now I figure the numbers could top 15 or 20 million.

From an antivirus standpoint, fixing Downandup isn't easy. The worm is particularly problematic because of the tricky way it involves the user in installing the software, bypassing auto-installation safeguards, plus its sophisticated way of avoiding detection, as it morphs its code constantly (using randomized elements) to make traditional, signature-based detection almost impossible.

Your best strategy for avoiding Downandup? Turn off AutoPlay/AutoRun on your computer (with Windows XP, TweakUI is the easiest way to do it). If you do see an AutoPlay dialog box like the one above, just close it and eject the disc or thumbdrive; browsing the drive manually for individual files should keep you uninfected, but you're best off not using the drive at all. And of course, make sure your system is fully patched via Windows Update.

What if you already have Downandup infecting your machine? Try your standard antivirus utility as a fix. If that doesn't work, F-Secure has a removal tool that should get rid of it. Good luck out there.

Source:

BABYLEG · 01-21-2009, 06:51 PM

your name is hey.........like heyt without the t

hey · 01-22-2009, 03:53 AM

i dont get it?

Smithilberry · 01-22-2009, 04:01 AM

hey hey hey like fat albert.... its the zany blunts no if ands about it

PS... hey is for horses

TeGo · 01-22-2009, 04:16 AM

lmfaoooo u niggas are stupid

Nikelz · 01-22-2009, 04:46 AM

Quote:

Originally Posted by Smithilberry

hey hey hey like fat albert.... its the zany blunts no if ands about it

PS... hey is for horses

i honestly meant to rep you b, iono wtf happened

and im serious :(

Smithilberry · 01-22-2009, 01:52 PM

Quote:

Originally Posted by Mr. Uriah C Rawls

i honestly meant to rep you b, iono wtf happened

and im serious :(

LOL

01-21-2009, 06:22 PM	#1
hey Veteran Join Date: Jul 2005 Posts: 2,780 Repped: 690 Repped 2,033 Times in 368 Posts Neg Reps: 21 Neg Repped at 14 Times in 13 Posts	Downandup/Conficker worm Downandup/Conficker worm ITS A BITCH !!!! udging from the complaints and questions filling my inbox, Windows security looks like it's already on track for its worst year this decade. The latest attack is a worm called Downandup, Downadup, Kido!, or Conficker (all the same thing), and it primarily seems to be being delivered via infected USB drives. How's it work? By tricking you into running the virus by modifying the way "autorun" works when you plug in a drive. Look closely at the screenshot above and you'll see two entries for "Open folder to view files." The one at the top is a phony entry that actually installs the virus on your machine... but of course it's the default selection that pops up when you plug in a drive. Once installed, the virus spreads like crazy via a separate flaw in Windows networking system (now patched, so be sure to run Windows Update if you haven't lately) and can quickly infect a whole office. F-Secure has more analysis on the clever way it tricks you into installing the malware yourself. How bad has it gotten? Estimates range from 3.5 million infected in the first four days after it bean spreading to 9 million impacted... and gettng worse. By now I figure the numbers could top 15 or 20 million. From an antivirus standpoint, fixing Downandup isn't easy. The worm is particularly problematic because of the tricky way it involves the user in installing the software, bypassing auto-installation safeguards, plus its sophisticated way of avoiding detection, as it morphs its code constantly (using randomized elements) to make traditional, signature-based detection almost impossible. Your best strategy for avoiding Downandup? Turn off AutoPlay/AutoRun on your computer (with Windows XP, TweakUI is the easiest way to do it). If you do see an AutoPlay dialog box like the one above, just close it and eject the disc or thumbdrive; browsing the drive manually for individual files should keep you uninfected, but you're best off not using the drive at all. And of course, make sure your system is fully patched via Windows Update. What if you already have Downandup infecting your machine? Try your standard antivirus utility as a fix. If that doesn't work, F-Secure has a removal tool that should get rid of it. Good luck out there. Source:

01-22-2009, 04:01 AM	#4
Smithilberry A.K.A. ZANY BLUNTS! Join Date: Oct 2004 Location: Qu€€n$ N€w ¥ø®k B!TcH€$! (718) Posts: 14,278 Repped: 2,201 Repped 1,295 Times in 708 Posts Neg Reps: 102 Neg Repped at 178 Times in 134 Posts	hey hey hey like fat albert.... its the zany blunts no if ands about it PS... hey is for horses __________________ A.K.A. Master Sensei Zany

01-22-2009, 04:16 AM	#5
TeGo Veteran Join Date: Feb 2008 Location: In Ya Bedroom Wit Da Nina, Where The Lube At? :ninja: Posts: 8,550 Repped: 1,220 Repped 1,699 Times in 772 Posts Neg Reps: 27 Neg Repped at 124 Times in 95 Posts	lmfaoooo u niggas are stupid __________________

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode

01-21-2009, 06:51 PM	#2
BABYLEG Ur Mom Sucked My Leg Head Join Date: Jan 2009 Location: Florida Posts: 3,816 Repped: 1,305 Repped 1,271 Times in 562 Posts Neg Reps: 98 Neg Repped at 128 Times in 112 Posts	your name is hey.........like heyt without the t

01-22-2009, 03:53 AM	#3
hey Veteran Join Date: Jul 2005 Posts: 2,780 Repped: 690 Repped 2,033 Times in 368 Posts Neg Reps: 21 Neg Repped at 14 Times in 13 Posts	i dont get it?