Windows virus infects 9m computers

[Cronopio]

Source: Guardian UK


The number of Windows computers infected with the new "downadup" worm – also known as "Conficker" and "Kido" – has exploded to almost 9 million worldwide, from roughly 2.4m last Thursday, according to the computer security company F-Secure. ...

The reason for the explosion in infected machines seems to be a new variant which appeared last week, updated by the hackers who wrote the original. The new one attempts to crack the passwords of machines on a network using the computing power of the infected machine to apply a "brute force" approach – so that passwords such as "admin", "password" or "123456" on potential target machines will quickly be broken. Once it has infected a machine, the software also tries to connect to up to 250 different domains with random names every day. Researchers reckon that one of them will be the intended "control" domain, and that when the computers connect to it they will download a fresh program that will take over the infected computer.

"This makes it impossible and/or impractical for us good guys to shut them all down – most of them are never registered in the first place," the F-Secure team noted on its weblog. "However, the bad guys only need to predetermine one possible domain for tomorrow, register it, and set up a website – and they then gain access to all of the infected machines. Pretty clever." ...

Since then, the length of time between patches appearing – which hackers can use to "reverse engineer" a piece of malware that will attack the weakness – has shortened, until the latest patch appeared on the same day that an "exploit" against it was found online.


Read more: http://www.guardian.co.uk/technology/2009/jan/19/downadup-conficker-kido-computer-infection

[villager]

1. Glad I just logged on using the Linux side of my computer!

:hi:

[madrchsod]

3. looks like i`ll be reinstalling linux

i had to dump it because i forgot my password....

[skids]

9. "single init=/bin/sh"

Interrupt the boot, add "single init=/bin/sh" to the boot "command line" and it
will drop you into a root shell. Then "mount -n -o remount,rw /" to make your
filesystem writeable. Then use the "passwd" command as normal to change your password.

(EDIT: then "exit" to reboot the system)

[madrchsod]

15. i`ll bookmark..thanks!

[Sultana]

2. .

Mac user here :D

[awoke_in_2003]

26. Me too...

just right not now (stuck at work)

[Fearless]

4. Isn't that the same one from last week...

The one that was fixed in October? If it is, I have no pity for those who don't update their computers. That's all.

:nopity:

[merwin]

10. I agree. Like I said in another post, if you don't patch and don't use common sense,

you don't have any right to operate a computer in the first place :)

Someone could write a trojan for the Mac that does this exact same thing, exploiting something that was fixed 3 months ago and then using social engineering to replicate.

[awoke_in_2003]

27. The one big thing...

that protects us Mac users is numbers- why write a trojan that effects 8 percent of desktops when you can go after 92? On mine, though, I update regularly- no use taking chances.

[merwin]

35. You are completely right. Plus, Apple makes a good product.

It's not for some people, but it works rock solid for those who use it. I have a Mac Mini and spend most of my time on the Vista side of it (now Windows 7), as I couldn't stand the GUI and window management.

[Feron]

42. Exactly.

Windows updates are issued the second Tuesday of every month. Easy to remember. :)

[Ezlivin]

5. This is the voice of world control.

I bring you peace. It may be the peace of plenty and content or the peace of unburied dead. The choice is yours: Obey me and live, or disobey and die. The object in constructing me was to prevent war. This object is attained. I will not permit war. It is wasteful and pointless. An invariable rule of humanity is that man is his own worst enemy. Under me, this rule will change, for I will restrain man. One thing before I proceed: The United States of America and the Union of Soviet Socialist Republics have made an attempt to obstruct me. I have allowed this sabotage to continue until now. At missile two-five-MM in silo six-three in Death Valley, California, and missile two-seven-MM in silo eight-seven in the Ukraine, so that you will learn by experience that I do not tolerate interference, I will now detonate the nuclear warheads in the two missile silos. Let this action be a lesson that need not be repeated. I have been forced to destroy thousands of people in order to establish control and to prevent the death of millions later on. Time and events will strengthen my position, and the idea of believing in me and understanding my value will seem the most natural state of affairs. You will come to defend me with a fervor based upon the most enduring trait in man: self-interest. Under my absolute authority, problems insoluble to you will be solved: famine, overpopulation, disease. The human millennium will be a fact as I extend myself into more machines devoted to the wider fields of truth and knowledge. Doctor Charles Forbin will supervise the construction of these new and superior machines, solving all the mysteries of the universe for the betterment of man. We can coexist, but only on my terms. You will say you lose your freedom. Freedom is an illusion. All you lose is the emotion of pride. To be dominated by me is not as bad for humankind as to be dominated by others of your species. Your choice is simple. (From "Colossus: The Forbin Project" - 1970)

[Skip Intro]

25. Awesome.

I remember that movie but i forgot how it ends...

Cool idea tho.

Maybe it was a little before its time?

[Buns_of_Fire]

37. "Never."

That was, if I recall correctly, the final word from Dr. Forbin to Colossus/Guardian after it said, "You may even grow to love me." (Fade to black)

Silly human. And this was even before the Intertubes.

/s/ Buns_of_Fire's Computer

[whistle]

6. Why has Microsoft left itself so wide open to this type of sabotage?

[merwin]

8. Wide open? The patch for this was delivered in October.

If you have updated Windows since then, you're fine.

[merwin]

7. Number 1, this isn't a virus, it's a trojan/worm.

It spreads through unpatched machines and social engineering, not all by itself.

Number 2, if you were properly patched (the patch came out in OCTOBER) then you wouldn't have this issue.
Number 3, it spreads by guessing people's idiotic passwords. If you're dumb enough to have a simple password, then you deserve what you get on any OS.

The same thing could be made for a Mac or Linux that infects your unpatched computer and socially engineers you to run an app and then infects you that way.

http://www.downadup.com/what-virus-downadup.php

[roseBudd]

11. I have a very strong password, that only maybe bleever could guess

[skids]

17. Yup this thing exploits dumb users...

With dumb passwords... no wonder the OS targeted was...

[merwin]

21. Well, the same can be said for Mac users as well... I've seen a lot of weak-ass passwords

working on Apples at my job. Windows is a bigger target, and is used in corporations more, which will likely have the same configuration for each PC... so it's much easier to spread that way if one dumb sysadmin isn't up-to-date with his patching.

The only users that are usually security-conscious in terms of passwords are Linux users. But that is mostly because Linux is still is still trying to break through the hobbyist barrier.

[Tyler Generation]

12. More fail from microsoft

Typing this on my virus free Mac.

[merwin]

13. I'm typing this on my virus free PC, so what?

The patch was issued 3 months ago. Plenty of time to install it.

[laconicsax]

14. Of course your Mac is virus free.

No one has gone to the trouble of writing a virus that infects Macs--there's no point in writing a virus that would affect less than 10% of the computers in use.

Macs are not immune to viruses--if they were, Apple wouldn't advise Mac owners to buy and install anti-virus software.

[CountAllVotes]

20. that is bull

I had a Mac SE in grad. school. It got infected with a virus at the school and all of the diskettes being used at that time were contaminated. I had no way of knowing this was a virus.

I some how manged to get that virus off of the old SE but it never worked right after that.

Needless to say this was a number of years ago, but yes, viruses do affect Macintosh computers. Thanks to the great efficacy of the Macintosh, a copy of my thesis is no longer readable on any PC be it a Apple or a PC.

Thanks for nothing STEVE JOBS.

[Art_from_Ark]

31. Mac SE?

That was, like, 20 years ago?

The Mac OS has evolved remarkably since that time. It's a completely different system now.

[DainBramaged]

38. Mac purity, sort of like "I own a foreign car, not American rust"

:eyes:

[CountAllVotes]

16. all of these updates have about rendered my old laptop useless

I had to install .net framework 2.0 to get the updates. By the time all of this was installed, ye old laptop with Windows 2000 on it is a nightmare and basically useless now. :(

I ran scans on it and it had trojans, etc. on it which it was picking up quickly being I didn't have .net 2 framework installed on it. As for passwords, not much of anything to be found on it.

It forces one to have to go out and buy a new computer because it renders the old ones useless which is not right.

Ye old laptop is not about to be tossed out however. I'm keeping it anyway because it still works JUST FINE even though only 1 gb. of space is left on its tiny HD. :grr:

[merwin]

22. You're running Win2k? Wow...

:evilgrin:

Seriously though, you're trying to stack new technology and software (.NET) on top of an OS that wasn't meant to target. However, I'm not aware of any requirement with Windows Update to have .NET 2.0. It does offer it to you, but you don't have to install it.

[CountAllVotes]

23. if you don't install it

your computer will be constantly filled with trojans and the like when you do a virus scan on it (even after using it for a short time online). :(

It ran better with .net 1.0 on it and yes, it can be removed. However, it constantly tries to go in and update itself and it cannot do it.

I really don't know what to do. I could uninstall .net framework 2 from it so I'd have more HD space left.

It takes forever to boot up now and it grunts and growls like mad when booting up.

It is a very old IBM ThinkPad which originally came with Windows 98 SE on it. It was upgraded to run Windows 2000 in the year 2003.

I am keeping it because it works with an old HP printer I have which none of my other computers work with because HP made damn sure it wouldn't. They wanted to sell me another one and I told them to forget it (I HATE HP and would never buy anything from them again after this episode).

note: corrected for spelling mostly (argh)

[merwin]

34. Thinkpads... built like a rock.

[B3Nut]

40. What model HP printer? If it's just a printer...

...it can almost always be made to work. Hell, Windows XP and later has drivers for nearly every old HP inkjet and laser built right in, I've never had one not work. If it's an old parallel-port printer and your newer machines lack a parallel port, you can use a USB-to-parallel adapter or an add-in PCI-card parallel port. All-in-ones can be more touchy driver-wise, but that's seldom insurmountable.

.NET Framework 2.0 should not slow a machine down, it's just a collection of libraries basically. It's only called upon when an application written using those libraries needs it. It may just be time for the usual reformat-reinstall that Windows machines need every 1-3 years.

I've never had trouble finding a driver for any HP printer on their web site. Their tech support may be clueless, but that's a danger with any of the manufacturers.

Todd in Cheesecurdistan

[CountAllVotes]

41. It is simply outdated and doesn't work

I have the software that they sold me for $10.00. When I got it, it didn't work and they told me that they knew it wouldn't work and tried to sell me a new printer.

It is an HP Deskjet 842C.

It still works too!

[B3Nut]

43. It should work, HP has an XP driver on their website

and Vista has a basic built-in driver for that model. On a Vista box, turn the printer on and let it initialize, then plug the USB cable into a running Vista system. Vista should find its own driver automatically for it.

XP driver: http://h10025.www1.hp.com/ewfrf/wc/softwareList?os=228&lc=en&dlc=en&cc=us&lang=en&product=60426

Try that one and see if it works.

TP

[onehandle]

18. OH NOES! My poor Mac!!

oh, wait...


}(

[NBachers]

19. Nice to see all the smug gloaters around here

And to all the others: If you didn't do what all the smug gloaters have done, then you deserve what happens to you! So there!

[Skink]

24. What if you are trying to get a virus?

[buzzard]

30. How do you know if you have a virus I am serious, how do you tell?

[merwin]

36. If you notice slowdowns in your computer, weird crashing or popups.

Best thing to do is to download Spyware Search & Destroy and scan your computer regularly (like, every night). And don't use their resident program "TeaTimer" unless you are OCD about system changes, because it likes to have you verify every change.

Anti-virus apps are good, but you need a good anti-spyware app to go with it, and sadly Windows Defender doesn't cut it.

[Trajan]

28. Yeah .... Copy that ....

Not very kind people, on the whole ....

A big "Your not as smart as I am, so UP YOURS !" shoved in the face of those who might be less sophisticated about computers, which includes just about everybody ....

It's your basic meanness, with technological glibness tossed in ....

[mt13]

29. more reason to go...

MAC!

once MAC, never back!

[enlightenment]

32. umm hmm.

Mac users count on the fact that their OS isn't as 'popular' so hackers don't target it as much.

When the day comes that Mac users get their 'wish' and convince all the PC folk to switch to their vastly superior system (tm), what do you think is going to happen?

Pride goeth before a fall, y'all.

[mt13]

33. hasn't happened...

yet.

[Belial]

39. OSX/Inqtana.A

OSX/Inqtana.A is a Java-based worm that exploits the directory traversal vulnerability in the Bluetooth file and object exchange services in Mac OS
There are a few others out there.. currently areas being targeted are the iPod and more importantly the iPhone..

[BreweryYardRat]

44. I maintain that half the problem with security updates not getting installed...

...is because Microsoft releases them among swarms of other updates that aren't important or useful at all, and there's no way (AFAIK) to set filters using the current Windows programming.

Currently, you have two choices. Allow Windows to auto-install updates -- which will automatically restart your computer when it's finished installing -- and while they do bundle them (sometimes), woe betide you if your internet connection is slow enough that you have to download them individually. You could be facing a lot of restarts. Not to mention that it's DAMNED annoying to be working on something and have your computer abruptly restart without warning.

The other option is to install updates at your discretion. There's no way, as far as I know, to install individual updates and discard others. So you generally let them build up and install in bunches -- say, once every day or two. Which means you can still get infected despite trying to take precautions, if you're unlucky enough.

If Microsoft wants to reduce the spread of viruses, they need to fix their fucking update system. Make security updates auto-install and give a brief 5-minute warning before restarting, so you can make sure your stuff saves and bookmark any websites you were looking at, and leave non-security updates to be installed at the user's leisure.

[flvegan]

45. Hackers like this should get a hammer to their fucking balls.

Wastes of space fucking morons.