Login or Sign Up to become a member!
LessThanDot Sit Logo

LessThanDot

System Admins

Less Than Dot is a community of passionate IT professionals and enthusiasts dedicated to sharing technical knowledge, experience, and assistance. Inside you will find reference materials, interesting technical discussions, and expert tips and commentary. Once you register for an account you will have immediate access to the forums and all past articles and commentaries.

LTD Social Sitings

Lessthandot twitter Lessthandot Linkedin Lessthandot friendfeed Lessthandot facebook Lessthandot rss

Note: Watch for social icons on posts by your favorite authors to follow their postings on these and other social sites.

Your profile

    Search

    XML Feeds

    Google Ads

    « VMware Powershell VI Toolkit 1.5 Released for Windows with 32 new cmdletsDo you use Metasploit to check if your servers are vulnerable? »
    comments

    Got this from Microsoft and decided would be good to share this with you

    Based on feedback from
    MVPs and other sources, we are concerned about the rise in reported
    infections due to the worm Win32/Conficker.B also known as
    “Downadup.” Though systems which have already applied the
    out-of-band released MS08-067 in October 2008 are protected,
    unpatched system users have experienced system lockout and other
    problems.

    Last week, we released a version of the Malicious Software Removal tool (MSRT) that
    can help remove variants of Win32/Conficker and other resources. Please
    share this information in your communities to help address this threat.

    Win32/Conficker.B
    exploits a vulnerability in the Windows Server service (SVCHOST.EXE) for
    Windows 2000, Windows XP, Windows Vista, Windows Server 2003, and Windows 2008.
    While Microsoft addressed this issue in October with Microsoft Security
    Bulletin MS08-067,
    and Forefront antivirus and OneCare (as well as other vendor’s anit-virus
    products) helped protect against infections, many systems that have not been
    patched manually through Server Update Services and Microsoft/Windows Update or
    through Automatic Updates have recently come under attack by this worm.
    Attacked systems may lock out users, disable our update services and block
    access to security-related Web sites:

    In response to this
    threat, Microsoft has:

    ·
    Updated the January version of the MSRT to
    detect and remove variants of Win32/Conficker.B. You can download this
    version from the MSRT from either the Microsoft
    Update site
    or through its associated Knowledge Base article.

    ·
    Created the KB article 962007 “Virus alert about the
    Win32/Conficker.B worm
    ” to provide public details on the symptoms and
    removal methods available to address this issue.

    ·
    Announced the release of the items and the virus threat itself on the Microsoft
    Malware Protection Center blog
    .

    It is our hope that these
    resources can assist you in resolving issues with unpatched, infected systems
    and that you can apply MS08-067
    to any other unpatched systems as soon as possible to avoid this threat.

    About the Author

    User bio imageDenis has been working with SQL Server since version 6.5. Although he worked as an ASP/JSP/ColdFusion developer before the dot com bust, he has been working exclusively as a database developer/architect since 2002. In addition to English, Denis is also fluent in Croatian and Dutch, but he can curse in many other languages and dialects (just ask the SQL optimizer) He lives in Princeton, NJ with his wife and three kids.
    Social SitingsTwitterFacebookLinkedInHomePageFlickrLTD RSS Feed
    5327 views
    InstapaperVote on HN

    6 comments

    Comment from: Phil B [Visitor] · http://pbarnhart.wordpress.com
    ****-
    Phil B According to http://www.downadup.com - a guide to removing this virus - its also important to disable AutoStart; a whole new infection vector is through USB drives.
    01/20/09 @ 15:50
    Comment from: Extremesecurity [Visitor] · http://extremesecurity.blogspot.com
    ****-
    Extremesecurity Did Downadup/conficker attack your network? I've created a batch file for system administrators to clean/patch/cure infected systems in their networks. check it out here: http://extremesecurity.blogspot.com/2009/01/beat-downadupconficker-like-pro-my.html
    01/22/09 @ 18:38
    Comment from: Charles Norrie [Visitor] Email
    Charles Norrie I appreciate any sensible person will want to patch their machine, but why not start out with one that does not need to be patched in the first place.

    If you use Linux, you'll never have to patch, because if you choose correctly, one like Ubuntu Intrepid Ibex, it's done for you automatically, and it's easier than Windows to install and FREE!
    01/30/09 @ 12:58
    Comment from: SQLDenis [Member] Email
    SQLDenis Charles Norrie, if you had automatic updates turned on then you would also be safe on windows since this was pushed out already in October or November of last year
    01/30/09 @ 13:08
    Comment from: Charles Norrie [Visitor]
    Charles Norrie Dear Mr SQLDenis,

    Unfortunately Conficker seems to be able to subvert the automatic update process to its own purposes and there's a battle royal between Redmond and US CERT about whether to switch it off or not.

    It's not for me to judge that outcome, but if it turns out it's neceassry to turn off Autoupdate there's going to have to be a lot of manual work.
    01/31/09 @ 10:01
    Comment from: Internet Security [Visitor] · http://blog.trendmicro.sg
    Internet Security Norton has patch for it but then you got to get into safe mode and do some changesw manually.
    09/18/09 @ 03:50

    Leave a comment


    Your email address will not be revealed on this site.

    To mislead the spambots.

    Your URL will be displayed.
    (Line breaks become <br />)
    (Name, email & website)
    (Allow users to contact you through a message form (your email will not be revealed.)