[DeadSilent]

This virus has hits millions of people and will continue to.. read this or risk possible infection.

Briefing:

Originally Posted by http://www.msnbc.msn.com/id/28779569/

By Amanda Raus
NBCConnecticut.com
updated 1 hour, 20 minutes ago
"You won $1000. Please click here."

Sounds so tempting.

But of course, it is a virus that has already made its way into millions of computers. The Downadup/Conficker worm infection is still rapidly spreading through Microsoft-based devices. Experts say it gets into your computer when you click on something you shouldn't.

"You click on the link, you're somewhere else and that's pretty much how," explained Saurin Shan, a member of the Geek Squad at Best Buy.

The virus can also invade your computer during everyday use. It leaves any personal information on your PC wide open to hackers.

"You could get it through your regular email, not knowing what to click, just browsing the web, which your kids do every day," said Shah.

Microsoft has released patches to counteract the virus, but experts say it's up to you to protect yourself by making sure you have the correct programs on your computer.

"Some of the things for everyday users that I recommend is to make sure they have proper up-to-date viruses, virus protection, spyware protection and just following along with the new updates put out by your computer manufacturer," said Shah.

If your computer is already infected, experts say you should take it to a professional. They've already seen this virus and know how to correct it.

"You don't know what file is infected, especially if you're not used to looking at it like I am every day," said Shah.

In Depth:

Originally Posted by http://www.pcmag.com/article2/0,2817,2339313,00.asp

Approximately six percent of computers scanned by Panda Security are currently infected by the Conficker/Downadup worm, Panda said Wednesday, dubbing the outbreak "an epidemic".

The worm, discovered earlier this month, exploits the Windows MS08-067 service vulnerability, a patch for which was released three months ago.

It spreads through USB memory devices like USB drives or MP3 players. The Windows option menu that appears after inserting the USB device will disguise the option to run the program as the option to open the folder. Open the file and release the worm.

Panda scanned two million computers and found that six percent are infected across 83 countries. Though it originated in China, it is now particularly virulent in the U.S., Spain, Taiwan, Brazil, and Mexico. Panda has identified about 18,000 infected machines in the U.S., though the number could be higher.

As is the case with a lot of malware, Conficker appears to launching brute force attacks to extract passwords from computer and corporate internal networks, Panda said. The easier the password, the easier it is for Conficker to decipher it. Once the passwords are detected, cyber criminals can access computers and use them maliciously.

"This is no doubt an epidemic and the worst may still be to come, as the worm could begin to download more malware onto computers or to spread through other channels," Luis Corrons, technical director of PandaLabs, said in a statement. "The outbreak of this worm really highlights the need for users to establish strong passwords."

F-Secure updated its Downadup removal tool on Monday. Affected users will need the most recent version of F-Downadup. F-Secure warned that the worm disables Automatic Updates, "so updated versions of MSRT will need to be downloaded manually, it will not be automatically installed on infected machines."

Is There A Fix?

Originally Posted by http://www.tgdaily.com/html_tmp/content-view-41140-108.html

Security
By Rick C. Hodgin
Thursday, January 22, 2009 10:19

Washington (DC) - The United States Computer Emergency Readiness Team (US-CERT) issued a warning on Tuesday, and updated it yesterday, regarding the Downadup worm that has infected over 10 million computers so far. They said Microsoft's original proposed fix does not address all versions of the Windows operating system.


The Downadup worm creates an "autorun.inf" file on every USB drive it finds on a Windows system. The AutoRun feature in Windows will automatically execute the instructions contained within, allowing CDs, USB and other removable media forms the ability to spontaneously start install programs, or programs specific to the media form (such as Encyclopedia CDs which launch their browser).

Microsoft originally advised a registry fix which would disable the AutoRun feature. However, US-CERT said that fix does not work on Windows 2000, XP and 2003 Server. Machines running Vista and Server 2008 will have received an automatic update, as part of the MS08-038 bulletin. The subsequent KB953252 support document describes how to manually install the fix for 2000, XP and Server 2003 users.

US-CERT warned that since Microsoft's solution only works on those systems which have the KB953252 patch applied, then only those systems which would have automatically received it would be rendered immune to this form of Downadup's attack. However, all other machines that have not manually applied the patch will still be vulnerable.

US-CERT identifies the problem with Microsoft's patch as an error in the Windows operating system which does not correctly identify two quantities. The first is the AutoRun feature, the second is the Multimedia Change feature.

Even if AutoRun is disabled, Windows 2000, XP and Server 2003 systems without the patch will load and execute the Downadup code. However, disabling the Multimedia Change feature, US-CERT's proposed solution, always works.

Microsoft contacted the US-CERT website and offered a direct link to KB953252 for those interested in manually applying the fix so that all versions of the Windows operating system will work correctly if disabling the AutoRun feature.

Several website commentators have also called for a new feature in Windows 7 which allows these types of registry-only fixes to be applied via some type of user interface screen, as changing the registry can be confusing and tricky business.

See US-CERT's Technical Cyber Security Alert TA09-020A bulletin.

Everyone should check their computers, and do what is necessary to stay safe.

Fix: http://www.symantec.com/security_res...408-99&tabid=3

Alternative Fix: http://www.ubuntu.com/

[obichan]

wow a virus haven't seen one of them before :P

[DrkSgn]

Well, I always check all links on my emails. So I won't got this creepy virus ><

Hahaha, another fix: Ubuntu xD. Very good!

[DeadSilent]

@obichan: You missed the point.

@DrkSgn: You didn't read what I posted.

It spreads through USB memory devices like USB drives or MP3 players. The Windows option menu that appears after inserting the USB device will disguise the option to run the program as the option to open the folder. Open the file and release the worm.

[DrkSgn]

HUm.... I see now.

[Tessu]

Wow, thanks god I barely click whatever it pop up, I only check really trusted links and site.

[obichan]

Originally Posted by DeadSilent

@obichan: You missed the point.

@DrkSgn: You didn't read what I posted.

no i picked it up it's a worm i dare say it probably works beter as a network file the on a USB device but still if people arn't smart enough to run a virus scan every time the connect USB device from another computer then it's there own fualt :P (it takes the best part of 20 secs to do so why not)

[acidboot3r]

Man I gotta stop downloading pronz then.....

[yozyoz]

i just don't understand how come people are so gullible to think that they just won $1000 out of nothing -_-"

[DeadSilent]

Originally Posted by obichan

no i picked it up it's a worm i dare say it probably works beter as a network file the on a USB device but still if people arn't smart enough to run a virus scan every time the connect USB device from another computer then it's there own fualt :P (it takes the best part of 20 secs to do so why not)

Its like having unprotected sex constantly and never getting checked.. you can only hope you don't have herpes.. but most likely you already did before hand and infected a bunch of clean computers. :o

At any rate, that sucks dude.. I'm not sure if I got it or not.. all my anti-everything tools tell me no.. but still I'm suspicious since I use two USB devices.. of course I've only ever used them on my computer... :\