Computer Hope

Software => Computer viruses and spyware => Topic started by: Zylstra on March 29, 2009, 04:11:45 PM

Title: Warning: Virus Season
Post by: Zylstra on March 29, 2009, 04:11:45 PM
Yes, I am totally invading this board with a sticky for a few days. Any moderator/specialist, feel free to desticky this around ~April 3rd or so.


This note is for everyone:
April 1st has often been a target day for malware programmers.
Recently, news of one particular virus that antivirus companies are getting stumped  over has caused a lot of fear.

Though you should do these things weekly, now is time to pay special attention:

If your updates are not working properly, reinstall your scanner ASAP. Dont wait.



Title: Re: Warning: Virus Season
Post by: evilfantasy on March 29, 2009, 05:09:04 PM
Good post O0

Just to add to the above suggestions, the best ways to be prepared for this upcoming threat is really something that should be done on a regular basis. Here are some easy solutions to help.

- Keep Windows up to date.( I know Zystra already mentioned it ) Microsoft has released many security updates to help block known exploits. Visit Microsoft Windows Update (http://www.windowsupdate.microsoft.com) and get all critical updates.
- Keep your antivirus and other security software up to date. The Secunia Personal Software Inspector (PSI) (http://secunia.com/vulnerability_scanning/personal/) is a great free tool that will inform you of out of date and end of life software.
- Disable autoruns. While AutoRuns are convenient they are also very easily exploited by this type of malware. Use the free Panda USB and AutoRun Vaccine (http://research.pandasecurity.com/archive/Panda-USB-and-AutoRun-Vaccine.aspx) to disable autoruns.
Title: Re: Warning: Virus Season
Post by: macdad- on March 29, 2009, 05:46:28 PM
Good post O0

Just to add to the above suggestions, the best ways to be prepared for this upcoming threat is really something that should be done on a regular basis. Here are some easy solutions to help.

- Keep Windows up to date.( I know Zystra already mentioned it ) Microsoft has released many security updates to help block known exploits. Visit Microsoft Windows Update (http://www.windowsupdate.microsoft.com) and get all critical updates.
- Keep your antivirus and other security software up to date. The Secunia Personal Software Inspector (PSI) (http://secunia.com/vulnerability_scanning/personal/) is a great free tool that will inform you of out of date and end of life software.
- Disable autoruns. While AutoRuns are convenient they are also very easily exploited by this type of malware. Use the free Panda USB and AutoRun Vaccine (http://research.pandasecurity.com/archive/Panda-USB-and-AutoRun-Vaccine.aspx) to disable autoruns.

Might I add Java and Flash Player  ;)
Title: Re: Warning: Virus Season
Post by: evilfantasy on March 29, 2009, 06:06:30 PM
Might I add Java and Flash Player  ;)

Yep!

Secunia should find any out of date files for you from Java and Flash.
Title: Re: Warning: Virus Season
Post by: Zylstra on March 30, 2009, 07:34:24 PM
It always amazed me how insecure FlashPlayer and Java can be for a system... there's a reason we dont have either running on this forum : )
Title: Re: Warning: Virus Season
Post by: macdad- on March 31, 2009, 06:11:25 AM
It always amazed me how insecure FlashPlayer and Java can be for a system... there's a reason we dont have either running on this forum : )

Thats why i use javascript.  ;)
Title: Re: Warning: Virus Season
Post by: Helpmeh on April 01, 2009, 04:51:33 PM
The april 1st virus (Conficker or Downandup) supposedly has infected over 15m PCs but harder data suggests the infection is in around 10m PCs.
Title: Re: Warning: Virus Season
Post by: Zylstra on April 01, 2009, 06:19:15 PM
Its speculated that Conficker isnt going to do anything right now...
(Also, it could be a time zone issue... wherever the programmers are living, it might not be April 1st yet? Who knows)

Its said they might be waiting for public concern to die down.


Conficker apparently updated itself today though, however, it continues to remain inactive.
I'm just glad I didnt arrive at school today with 300 computers staring at me with some weird virus message that I would have to try and fix.

Here is what I read:

http://www.crn.com/security/216402353
Title: Re: Warning: Virus Season
Post by: evilfantasy on April 01, 2009, 06:36:28 PM
Local news reports are saying users have been getting infected by fake Facebook emails. But this is all before today so no telling what the "zombie masters" are planning.
Title: Re: Warning: Virus Season
Post by: macdad- on April 01, 2009, 06:40:59 PM
Its speculated that Conficker isnt going to do anything right now...
(Also, it could be a time zone issue... wherever the programmers are living, it might not be April 1st yet? Who knows)

Its said they might be waiting for public concern to die down.


Conficker apparently updated itself today though, however, it continues to remain inactive.
I'm just glad I didnt arrive at school today with 300 computers staring at me with some weird virus message that I would have to try and fix.

Here is what I read:

http://www.crn.com/security/216402353


Ditto, when i first logged onto one of the PCs i updated Sophos.  ;)
Title: Re: Warning: Virus Season
Post by: BC_Programmer on April 01, 2009, 07:26:37 PM
Like I say- a lot of things are going to be blamed on this that are completely unrelated.
Title: Re: Warning: Virus Season
Post by: evilfantasy on April 01, 2009, 07:33:43 PM
Agreed. That's why I want logs in malware removal. I'm infected with "fill in the blank" is only accurate about 10% of the time...
Title: Re: Warning: Virus Season
Post by: BC_Programmer on April 01, 2009, 07:34:57 PM
watch, "OH NOES! Balloon tips aren't appearing! BLAST YOU CONFICKER!" *attaches clean log*

LOL

Title: Re: Warning: Virus Season
Post by: evilfantasy on April 01, 2009, 07:44:51 PM
Also depending on what scanner it is there could be multiple names for the same infection. The Conficker worm is also referred to as Downloadup. Then there is Conficker A, B, C, D and Win32 Conficker and on and on.

    * Win32/Conficker.A (CA)
    * W32.Downadup (Symantec)
    * W32/Downadup.A (F-Secure)
    * Conficker.A (Panda)
    * Net-Worm.Win32.Kido.bt (Kaspersky)
    * W32/Conficker.worm (McAfee)
    * Win32.Worm.Downadup.Gen (BitDefender)
    * Win32:Confi (avast!)
    * WORM_DOWNAD (Trend Micro)
    * Worm.Downadup (ClamAV)

http://en.wikipedia.org/wiki/Conficker
Title: Re: Warning: Virus Season
Post by: macdad- on April 02, 2009, 11:38:02 AM
Hey evil, are these like the file names of conficker?

Just wondering
Title: Re: Warning: Virus Season
Post by: evilfantasy on April 02, 2009, 11:46:47 AM
It's what different companies call it.

* Win32/Conficker.A (CA) <- http://www.ca.com/us/anti-virus.aspx
* W32.Downadup (Symantec) Norton/Symantec
* W32/Downadup.A (F-Secure) <- http://www.f-secure.com/en_EMEA/security/
* Conficker.A (Panda) <- http://www.pandasecurity.com/infected_or_not/us/

And so on. The same infection may have multiple names. Depends on what scanner you are using.
Title: Re: Warning: Virus Season
Post by: Zylstra on April 02, 2009, 08:45:47 PM
I wish antivirus companies would use a better naming system... it does *look* confusing to newer computer users.
But, its usually easy to search for... still, I wish they would also use universal names so that solutions could be found easier.


But, competition prevents this from happening.