|
|
|
|
Windows Secrets NEWS UPDATE • Issue 191 • 2009-03-30 • Circulation: over 400,000 |
|
AD
|
|
Table of contents TOP STORY: Run a Conficker removal tool before April 1 YOUR SUBSCRIPTION: Change your preferences or unsubscribe |
|
ADS
|
|
TOP STORY Run a Conficker removal tool before April 1 
By
Brian Livingston
Computers infected with the infamous Conficker worm will start scanning the Internet for instructions this April Fools' Day, and the results won't be a funny joke. I'm publishing a special news update today to correct some misinformation that's been circulating and to give you a 1-2-3 approach that should cure most Conficker infections before April 1. In a technical analysis, the nonprofit security group SRI International states that millions of PCs have become infected with Conficker. It's "the most dominating infection outbreak since Sasser," a worm that raced across the Internet in 2004, SRI says. Writer John Markoff opined in a New York Times blog post on March 19 that Conficker's bot army "could possibly become the world's most powerful parallel computer." Something tells me this network isn't going to be used to search for signs of intelligent life in the universe. First of all: Whatever you've heard, don't panic. Most Windows Secrets readers don't have PCs infected with Conficker. The SRI analysis estimates that 54% of the affected machines are in China, Russia, India, Brazil, and Argentina, where many people use unauthorized Windows knockoffs. (Microsoft doesn't provide all its patches to unlicensed copies of Windows, leaving the vulnerable machines free to attack us — a self-defeating policy recently described by security expert Bruce Schneier.) Second: You've probably already protected yourself by acting on contributing editor Woody Leonhard's Jan. 22 Top Story, which details how to patch your PC against Conficker. More recently, Susan Bradley's March 5 article explained how to prevent Windows' AutoRun function from exposing your machine to Conficker or any other malware. Third: However many PCs are in Conficker's bot army, they won't all launch a massive attack on April 1. Instead, that's the date on which the bots will start looking for instructions. The infected machines are programmed to query several hundred domain names of possible control servers a day. It'll take weeks for most of the bots to connect (although they can cause a lot of spam or denial-of-service attacks after they do). The biggest problem? The Conficker program (also known as Downadup and Kido) has morphed. The first two versions, Conficker.A and Conficker.B, began circulating in November 2008 and February 2009, respectively. Security researchers were able to neutralize the domain names that the worm's author would have used to send commands to the bot army. But new Conficker strains have appeared — version B++ since Feb. 20 and version C since March 4 — that bear new evils. (To add to the confusion, Microsoft refers to Conficker version B++ as C and version C as D.) Among other things, Conficker.C adds a peer-to-peer control mechanism that will make it harder for security firms to cut the head off the network. The C variant also relies on 500,000 possible domain names as instruction servers, frustrating security groups' attempts to disable them all. Domain-name blocking defeats many removal tips In perhaps the worm's cruelest behavior, a computer infected with Conficker.C is prevented from accessing many security-oriented Web sites. When a user tries to get patches from, say, Microsoft or Symantec, a browser will time out, suggesting to the user that the site is down. Conficker.C interferes with access to sites containing the following strings (as well as scores of other strings not shown here) in any portion of the URL: antivir ca. cert. conficker f-secure kaspersky mcafee microsoft msdn. msft. norton panda safety.live sans. symantec technet trendmicro windowsupdate Computer Associates' security advisory 77976 lists all the strings that Conficker.C currently obstructs. If your PC is infected, a technical trick might enable you to visit a site that Conficker is blocking. Instead of entering the site's domain name in your browser's address bar, enter the site's dotted-decimal IP address instead, which Conficker doesn't seem to interfere with. (My thanks to Woody Leonhard for his help with this tip.) For example, Conficker might block your browser from showing the Computer Associates advisory I just mentioned. If so, you could replace the domain name shown in the first line below (www.ca.com) with the dotted-decimal IP address shown in the second line (130.119.248.144): www.ca.com/us/securityadvisor/virusinfo/virus.aspx?id=77976 130.119.248.144/us/securityadvisor/virusinfo/virus.aspx?id=77976 Here's one way to learn the IP address of a Web site: using an uninfected PC, open a Firefox window and install the Show IP browser extension. With this extension enabled, the IP address of whatever site you're visiting shows up in the browser's status bar. Of course, if you navigate to a site using its IP address and then click a link, the site will probably use a spelled-out domain name in the link. Conficker would block the resulting page, which you'd have to replace manually with its dotted-decimal equivalent. Conficker's blocking of security sites is little-understood by most journalists. For this reason, many fix-it tips from usually reliable sources won't actually help the victims:
How to update your PC and remove Conficker The following steps should prevent infection by Conficker and eliminate the worm, if your PC has it. One positive side effect is that you'll enjoy a computer with up-to-date patches:
It's best to strengthen your defenses before April 1 rather than waiting to see what bad things might happen. No paid content; next regular newsletter April 2 News updates have no paid content. The same articles are sent to both free and paid subscribers. The Windows Secrets Newsletter is published on the 1st through 4th Thursdays of each month, with breaks for Thanksgiving week and the last two weeks of August and December. The next full e-mail newsletter will be published on April 2. Brian Livingston is editorial director of WindowsSecrets.com and co-author of Windows Vista Secrets and 10 other books. |
|
ADS
|
|
YOUR SUBSCRIPTION The Windows Secrets Newsletter is published weekly on the 1st through 4th Thursdays of each month, plus occasional news updates. We skip an issue on the 5th Thursday of any month, the week of Thanksgiving, and the last two weeks of August and December. Windows Secrets resulted from the merger of several publications: Brian's Buzz on Windows and Woody's Windows Watch in 2004, the LangaList in 2006, and the Support Alert Newsletter in 2008. Publisher: WindowsSecrets.com LLC, Attn: #120 Editor, 1700 7th Ave., Suite 116, Seattle, WA 98101-1323 USA. Vendors, please send no unsolicited packages to this address (readers' letters are fine). Editorial Director: Brian Livingston. Senior Editor: Ian Richards. Editor-at-Large: Fred Langa. Technical Editor: Dennis O'Reilly. Program Director: Tony Johnston. Program Manager: Ryan Biesemeyer. Web Developer: Damian Wadley. Research Director: Katy Abby. Copyeditor: Roberta Scholz. Contributing Editors: Susan Bradley, Scott Dunn, Mark Joseph Edwards, Stuart J. Johnston, Woody Leonhard, Ryan Russell, Becky Waring. Trademarks: Microsoft and Windows are registered trademarks of Microsoft Corporation. The Windows Secrets series of books is published by Wiley Publishing Inc. The Windows Secrets Newsletter, WindowsSecrets.com, Support Alert, LangaList, LangaList Plus, WinFind, Security Baseline, Patch Watch, Perimeter Scan, Wacky Web Week, the Logo Design (W, S or road, and Star), and the slogan Everything Microsoft Forgot to Mention all are trademarks and service marks of WindowsSecrets.com LLC. All other marks are the trademarks or service marks of their respective owners. HOW TO SUBSCRIBE: Anyone may subscribe to this newsletter by visiting our free signup page. WE GUARANTEE YOUR PRIVACY: 1. We will never sell, rent, or give away your address to any outside party, ever. 2. We will never send you any unrequested e-mail, besides newsletter updates. 3. All unsubscribe requests are honored immediately, period. Privacy policy HOW TO UNSUBSCRIBE: To unsubscribe from the Windows Secrets Newsletter,
|
