Conficler alert

  • Thread starter Thread starter Ernie B.
  • Start date Start date
E

Ernie B.

A friend who usually knows whereof he speaks sent this...
=========================================================
Hey everybody,

The Conficker virus is no joke about being activated April 1st. You
may already have it on your system just waiting for the date to
change. If you have it, it's much better to get rid of it before it
activates. As always, keep your "bug catchers" updated regularly.

Grab this tool directly from McAfee to scan & remove this specific
threat: http://67.97.80.71/vil/conficker_stinger/Stinger_Coficker.exe

With several variants already out there, McAfee has pledged to update
this tool daily as new variants are discovered, therefore I recommend
you RUN it directly from McAfee without saving it to your computer to
get the most current update.
=============================================================
 
Ernie B. said:
A friend who usually knows whereof he speaks sent this...
=========================================================
Hey everybody,

The Conficker virus is no joke about being activated April 1st. You
may already have it on your system just waiting for the date to
change. If you have it, it's much better to get rid of it before it
activates. As always, keep your "bug catchers" updated regularly.

Grab this tool directly from McAfee to scan & remove this specific
threat: http://67.97.80.71/vil/conficker_stinger/Stinger_Coficker.exe

With several variants already out there, McAfee has pledged to update
this tool daily as new variants are discovered, therefore I recommend
you RUN it directly from McAfee without saving it to your computer to
get the most current update.
Click to expand...

It's like a game sometimes - where you find how many different ways you
can spell one name.

....I got one - cornflicker - no wait! confickler.
 
FromTheRafters said:
It's like a game sometimes - where you find how many different ways you
can spell one name.

...I got one - cornflicker - no wait! confickler.
Click to expand...

When will they get around to cornholer, tomorrow?
BTW: it's already April fools day UTC
 
Frankster said:
Here's the Trend Micro conficker removal program link - no sign-up required.
Click to expand...

Seems that you have to be a current subscriber to use this cleanup tool.
 
A friend who usually knows whereof he speaks sent this...
=========================================================
Hey everybody,

The Conficker virus is no joke about being activated April 1st. You
may already have it on your system just waiting for the date to
change. If you have it, it's much better to get rid of it before it
activates. As always, keep your "bug catchers" updated regularly.

Grab this tool directly from McAfee to scan & remove this specific
threat: http://67.97.80.71/vil/conficker_stinger/Stinger_Coficker.exe

With several variants already out there, McAfee has pledged to update
this tool daily as new variants are discovered, therefore I recommend
you RUN it directly from McAfee without saving it to your computer to
get the most current update.
=============================================================
Click to expand...

Hello:

Full credit goes to Autumn in the a.p.s newsgroup for passing on a more
comprehensive list of anticonficker utilities:

<http://www.confickerworkinggroup.org/wiki/pmwiki.php?n=ANY.RepairTools>

Thank you Autumn!

Pete
 
David said:
From: "NoTechie" <[email protected]>

| Thanks, Ernie, I am clean as of 6:30 p.m. Will try again tonightl

LOL -- If you are clean now but maybe not clean later and you have to scan again... You
have a BIGGER problem !
Click to expand...
Why would I have a bigger problem if I scanned later before April 1?

I have WinXP Pro, ser. pack 3. Also, in the Win page, there is no patch
for that.
 
It's like a game sometimes - where you find how many different ways you
can spell one name.

...I got one - cornflicker - no wait! confickler.
Click to expand...
I made a typo. So, sure me already. ;-)
 
It's like a game sometimes - where you find how many different ways you
can spell one name.

...I got one - cornflicker - no wait! confickler.
Click to expand...
I made a typo. So, sue me already. ;-)
 
That site isin't coming up for me.

A tracerout to it (149.20.56.65) times out after the 14'th hop, which is
149.20.54.223 (shadowserver.org).

Perhaps it's being Ddos'd.
Click to expand...

Hello VG:

I just checked 30 seconds ago OK. Maybe their server was hosed with
incoming from last minute requests.

I've downloaded about 8 out of their 10 tools and have been testing them
out to see if any have "gotchas" but so far, they seem seem good to go.

Pete
 
David H. Lipman said:
If you had MS08-067 installed, disabled AutoPlay and AutoRun,
were behind a NAT Router or a FireWall
Click to expand...

Yes, all true.
and had your AV appluication up to date
Click to expand...

I don't think it's true that any AV app would have blocked conficker
from getting onto any system back during November, December and possibly
January. If so, then the AV proviso condition in your list is not
correct.
then you would NOT need to do a "On Demand" scan specific
to the Conficker worm.
Click to expand...

One more proviso: If you are running Windows NT or 98 or a MAC or any
version of unix (then you would not need to do a scan for conficker).

BTW, why was this posted to alt.att? What is that group?
 
Virus Guy said:
Yes, all true.


I don't think it's true that any AV app would have blocked conficker
from getting onto any system back during November, December and
possibly
January. If so, then the AV proviso condition in your list is not
correct.
Click to expand...

Good point. Especially considering no reactive AV is *ever* really
up-to-date.

However, had the OP contracted the worm, it would be difficult to have
kept it anywhere near up-to-date as the worm interferes with many
security related processes. If you now find your AV is 'up-to-date' then
it is unlikely you are infested. In this case the currentness of of AV
is used as an indicator.
One more proviso: If you are running Windows NT or 98 or a MAC or any
version of unix (then you would not need to do a scan for conficker).
Click to expand...

As it now stands, perhaps. However, an update can target new propagation
paths and techniques. Keep in mind that future attacks from this will
mostly come from "inside" trusted networks. Commercially, it makes most
sense that these will become spambots.
 
BTW, why was this posted to alt.att? What is that group?
Click to expand...
It's a group that I hang out in, composed of ex-Worldnetters. We migrated
here when at&t completely hosed the internal help groups. For me, that was
the last straw after years of working around their email blacklist.
 
Back
Top