Conficker Worm news

Just received this in an email from Zone Alarm:

A recent development regarding the Conficker virus has been detected, where it is now directing infected machines to download new, harmful files, thus activating the botnet. Here’s how this new behavior works:

Conficker sends out email spam without the PC owner’s knowledge. In addition, Conficker uses pop-ups to warn of PC infection and offers fake antivirus software, called 'SpywareProtect2009' at a price of $49.95. If purchased, credit card information is stolen and the virus downloads even more malicious software.


If you encounter a pop-up like this, do not click on the pop-up at all - not even to close the box. To remove the pop-up without infection, open your Task Manager (Ctrl+Alt+Delete), and end the task from your Browser (Explorer, Firefox, etc.). You should take additional precautions to ensure you are not already infected and have adequate protection:

* Keep your Operating Software up-to-date
* Learn more about Conficker

ZoneAlarm by Check Point - Award winning PC Protection, Antivirus, Firewall, Anti-Spyware, Identity Protection, and much more.

* Invest in a high-end security product

Good to know, Thanks. +1

Job Security for some..................I have had at least 100+ PC's in the shop the past month that had Spyware Protect 2009 or some other variant.

"Random pop-up, I better click it and purchase this"..................

Just throw in a Slax CD, boot up and remove the offending junk.

Thanks, I have had to delete this from a customers PC. They clicked on the link!
It's easy done if you don't know about it.

that means more cleanups for me (people now know something is wrong as to before when it was silent)...:huh:

im still in awe on how much technology this little worm has put in...:huh:
its really unheard of and im guessing its only going to get worse as this (from what im predicting) the new gold standard for worms...:shock:


and i agree with the slax based solution...
might as well use bt3...

I tell customers that if they get a pop-up like that, Alt + F4..................DO NOT ATTEMPT TO CLICK ON ANYTHING.

darkassain said:

that means more cleanups for me (people now know something is wrong as to before when it was silent)...:huh:

im still in awe on how much technology this little worm has put in...:huh:
its really unheard of and im guessing its only going to get worse as this (from what im predicting) the new gold standard for worms...:shock:


and i agree with the slax based solution...
might as well use bt3...

Click to expand...

maybe a copper standard, as i believe this is just a start, a test, a feel around if you may... second time, with a variant this time.... kinda like a rechargeable battery if you can think of it like so. *****ed prodded and probed. Tis the way of the "wormy". An expensive education at times as well.

Unfortunately, Digger is probably 100% correct - now that it is being detected by everything and it's mother, and ye t is *still* managing to proliferate, it is time to start calling out to the zombies and forcing to do the will o' the bots....

This is only going to get uglier.

Coincidentally, I just got the same email while I was typing this....

Digger said:

maybe a copper standard, as i believe this is just a start, a test, a feel around if you may... second time, with a variant this time.... kinda like a rechargeable battery if you can think of it like so. *****ed prodded and probed. Tis the way of the "wormy". An expensive education at times as well.

Click to expand...

yeah im feeling the same way...
and the figures dont lie when a huge # of people with the worm corralates to the number of *pirated* systems...
and that huge part of these computers are (geo-ip) wise in china....

it is almost impossible for the security community to get all of the domains as they need them all and the author only needs one..
its only a matter of time before he hits and bam! p2p connections till there is no tomorrow..

its public key tech that has the security community stumped as there is no way
to go around it....

unlike the rest of malware author this author is actively responding to the consortium...