Downadup infesting computers like crazy!

[Smith6612]

Hey guys, I just wanted to let you guys know about a nasty infection that had come out last week. Within the last 4 days, it has already taken roughly 8 Million + computers. Here's some details on this infection. Be sure to check out the links in the topic as well. http://www.dslreports.com/forum/r21746119-Downadup-Worm-infects-million-of-PCs-in-the-past-24-hours

Thought you guys should be aware of this. The virus by the sounds of it is targeting this Microsoft Patch or systems with it not installed. Not sure though.
http://www.microsoft.com/technet/security/Bulletin/MS08-067.mspx

F-Secure's website on this issue: http://www.f-secure.com/weblog/archives/00001582.html

EDIT: I would also like to note, it's been stated that infected machines are also possibly trying to exploit websites, so keep an eye on your web logs! If you see multiple IPs connecting very quickly, something is going on.

 

[ichwar]

I run linux for all my web access, so I guess I don't have to worry about this?
If you're concerned about multiple IPs connecting very quickly, the free version of ZoneAlarm does a very good job of blocking ALL incoming connections. That's what I've been using...

 

[Spartan Erik]

Hm I heard that this only affected machines that weren't up to date with the latest patches from Microsoft

 

[ichwar]

Hm I heard that this only affected machines that weren't up to date with the latest patches from Microsoft

Right, and mine isn't up to date. I've got the initial installation of Vista Ultimate with out any following updates or service packs... :eek4:

 

[nchgaming]

Anyone running WINDOWS SHOULD make sure that they have their system updated! (http://www.update.microsoft.com/) This virus infects windows machines, by exploiting the "AutoRun" function that you see pop up when you INSTALL or plug in a USB drive. When that neat little window that asks... how you would like to open the drive for access, pops up.....look for (2) TWO options to "open as....", where you should only have ONE. If you click the first of the two...you ARE infected. Full documentation is available here at CNN.com

 

[ichwar]

Anyone running WINDOWS SHOULD make sure that they have their system updated! (http://www.update.microsoft.com/) This virus infects windows machines, by exploiting the "AutoRun" function that you see pop up when you INSTALL or plug in a USB drive. When that neat little window that asks... how you would like to open the drive for access, pops up.....look for (2) TWO options to "open as....", where you should only have ONE. If you click the first of the two...you ARE infected. Full documentation is available here at CNN.com

I'd update my sustem, but I'm running a virus that blocks all network activity to download.microsoft.com and update.microsoft.com

Maybe I should try and take that off sometime soon...:biggrin:

 

[Jordan C]

I feel 100% safe over here on Mac. Anyone care to join me?

 

[ichwar]

no. The first virus I ever saw was on a mac.
I'll stick with linux, thank you!
Edit:
Ok, I don't know if this works or not, but Amit over at labnol.org says that you can keep this virus from infecting your computer by disabling auto play. As I said, I'm not sure that will work, but I'm definately going to do it any ways, cause this sounds like a REALLY bad virus... Wikipedia says that once it gets onto your computer, it downloads more viruses from the internet!!!

So, here are the steps to disabling auto play:

To prevent Conficker virus from infecting your Windows computer, you first need to disable the AutoRun feature. This can be done by downloading and installing certain updates manually for Windows XP or Windows 2000. Windows Vista users can skip this step as this is taken care of via automatic updates.

Now click Start, Run and enter gpedit.msc and click OK.

Under Computer Configuration, expand Administrative Templates. Now for Windows XP, click System and for Windows Vista, click Windows Components then Autoplay Policies. In the Settings pane, right-click Turn off Autoplay, and then click Properties.

Click Enabled, and then select All drives in the Turn off Autoplay box to disable Autorun on all drives. Click OK and restart the computer.



Alternately, you can go on over to his site for more detailed instructions: http://www.labnol.org/software/tutorials/secure-computer-disable-autorun/6698/

I hope no one here gets it!

 

[Parsa44]

It really is not hard to patch your computers, thats all you need to do and your safe.