Busted! Conficker's tell-tale heart uncovered

The Register ^ | 30 March 2009 | Dan Goodin

[ShadowAce]

[sionnsar]

ping!

[ReleaseTheHounds]

Dear Tech Freepers,

Please advise: should we less-than-tech-savvy Freepers just follow one or more of the links mentioned in this article and do a scan? I have McAfee Security Center — will running an extra scan or two on that be sufficient?

Thanks for your recommendations.

[antiRepublicrat]

Now nobody has any business being infected. Download the free nmap, configure according to instructions, and run against your network.

[mysterio]

Malwarebytes.org. Best malware remover I’ve ever worked with.

[antiRepublicrat]

Go to this security site.

The first option requires that you first download and install the Python language interpreter, then download, unzip and run the scanner.exe program according to the instructions at the top. Scan another machine by putting in the IP address, or scan your own using 127.0.0.1.

The best answer, especially if you're scanning more than one machine, is to use the nmap instructions at the first link I gave. Download and install nmap and run according to instructions.

These are white-hat hacker sites, better known as "computer security experts," so you can generally trust what's posted there. Their reputations and careers would be gone if they pushed malicious code themselves.

[fanfan]

I have AVG 8.5

Is that enough?

[green pastures]

I don’t have a network to deal with, just my sister’s laptop dell. It has Norton 360, which I updated yesterday. I also ran malwarebytes a few weeks ago and it came up clean.

I became the default IT person for my sister— even though I don’t know much about PCs, I know more than she does about them...

:-(

[Rammer]

ping

[ShadowAce]

You may want to go ahead and try to update it again today. The article says the fix was coming out today—so yesterday may have been a little early.

[nathanbedford]

cornping

[ReleaseTheHounds]

OK, antiRepublicrat... you probably thought you had a reasonably tech-savvy Freeper with me, but obviously you were wrong.

I went to that site you linked to (DoxPara Research). I then used your link to download and install the Python Language. I then downloaded and unzipped the scanner.exe program you linked to (this gave me something called “the pydoc”?). When I clicked “open browser” under this window, I get a page called “Python: Index of Modules”...

Am I getting close to where I can run the scanner? It’s not clear to me how to go from these downloads to running the scan.

Thanks in advance for the help.

[Syntyr]

ReleaseTheHounds,

1. Download and install the second link from antiRepublicrats message. This is the Python Language. The file is python-2.6.1.msi. Just accept the defaults and everything should be good.

2. Download the file in the thrid link in his message. The scs.zip file. Extract the contents of scs.zip to a folder on your PC. Most likley c:\scs.

3. Run a command prompt - i.e. click START then RUN enter CMD and press OK

4. Change to the folder with the scs scanner in it - i.e. CD\SCS and press enter

5. Scan your PC - SCANNER 127.0.0.1 and press enter. 127.0.0.1 is what is called the loopback IP address. Its the default ip address of you PC. It menas scan the PC you ar erunning the command from.

you can scan multiple PC’s by entering their IP address with the command SCANNER “ip address”

HTH

[antiRepublicrat]

The zip file should have 13 files in it, including scanner.exe.

Sorry, I pointed you there before I tried it myself. You didn't need to install the Python language since the zip comes with the Python run-time (I don't have Python installed in my Windows virtual machine, and it ran).

Here are the easy instructions after you've downloaded the file (don't type the quotes):

1. Click Start, click Run
2. Type "cmd" and hit Enter
3. In the DOS box, type "c:" and hit Enter
4. Type "md \scanner" and hit Enter
5. Unzip the contents of the zip into c:\scanner
6. Back in the DOS box, type "cd\scanner" and hit Enter
7. Type "scanner.exe 127.0.0.1" and hit Enter
8. When done, type "exit" and hit Enter

You can replace "127.0.0.1" with any IP address in your network, or any IP address outside of your network, but people may not be happy with you.

[TChris]

I have AVG 8.5

Is that enough?

Probably yes.

Make sure the virus definitions are up to date and that you have all the current Microsoft updates installed.

Windows Defender is pretty good spyware protection too. I run it along with AVG.

[fanfan]

Thank you.

[Marie Antoinette]

ping

[Still Thinking]

Thanks, aR. Nerd that I am, I already have Python loaded, so it was the work of about a minute to load and run the scanner.

[TheBattman]

Why does it have to be so convoluted? And yes, I am operating from the slightly biased point of view of a Mac users...