THIS IS NOT A JOKE - Widespread computer worm to hit on April 1st

[Mosco]

Below is a copy of an email from my mom who works for a large software company, please rest assured that ZERO of this is a joke:

BEGIN EMAIL:

National Cyber Alert System

Technical Cyber Security Alert TA09-088A


Conficker Worm Targets Microsoft Windows Systems

Original release date: March 29, 2009
Last revised: March 30, 2009
Source: US-CERT


Systems Affected

* Microsoft Windows


Overview

US-CERT is aware of public reports indicating a widespread
infection of the Conficker/Downadup worm, which can infect a
Microsoft Windows system from a thumb drive, a network share, or
directly across a corporate network, if the network servers are not
patched with the MS08-067 patch from Microsoft.


I. Description

Home users can apply a simple test for the presence of a
Conficker/Downadup infection on their home computers. The presence
of a Conficker/Downadup infection may be detected if a user is
unable to surf to their security solution website or if they are
unable to connect to the websites, by downloading detection/removal
tools available free from those sites:

* http://www.symantec.com/norton/theme...conficker_worm
* http://www.microsoft.com/protect/com...conficker.mspx
* http://www.mcafee.com


If a user is unable to reach any of these websites, it may indicate
a Conficker/Downadup infection. The most recent variant of
Conficker/Downadup interferes with queries for these sites,
preventing a user from visiting them. If a Conficker/Downadup
infection is suspected, the system or computer should be removed
from the network or unplugged from the Internet - in the case for
home users.


II. Impact

A remote, unauthenticated attacker could execute arbitrary code on
a vulnerable system.


III. Solution

Instructions, support and more information on how to manually
remove a Conficker/Downadup infection from a system have been
published by major security vendors. Please see below for a few of
those sites. Each of these vendors offers free tools that can
verify the presence of a Conficker/Downadup infection and remove
the worm:

Symantec:
http://www.symantec.com/business/sec...011316-0247-99

Microsoft:
http://support.microsoft.com/kb/962007
http://www.microsoft.com/protect/com...conficker.mspx


Microsoft PC Safety hotline at 1-866-PCSAFETY, for assistance.

US-CERT encourages users to prevent a Conficker/Downadup infection by
ensuring all systems have the MS08-067 patch (see
http://www.microsoft.com/technet/sec.../MS08-067.mspx),
disabling AutoRun functionality (see
http://www.us-cert.gov/cas/techalerts/TA09-020A.html), and
maintaining up-to-date anti-virus software.


IV. References

* Microsoft Windows Does Not Disable AutoRun Properly -
http://www.us-cert.gov/cas/techalerts/TA09-020A.html

* Virus alert about the Win32/Conficker.B worm -
http://support.microsoft.com/kb/962007

* Microsoft Security Bulletin MS08-067 - Critical -
http://www.microsoft.com/technet/sec.../MS08-067.mspx

* MS08-067: Vulnerability in Server service could allow remote code
execution -
http://support.microsoft.com/kb/958644


* The Conficker Worm -
http://www.symantec.com/norton/theme...conficker_worm

* W32/Conficker.worm -
http://us.mcafee.com/root/campaign.asp?cid=54857

* W32.Downadup Removal Tool -
http://www.symantec.com/business/sec...011316-0247-99

END EMAIL

[B Square]

Have been following this for the past week and have updated all protection. Hopefully I am wormless Thanks for the info.

[Marrk]

So, it's almost noon in California. Has anything come of this yet?

[seantk]

Thanks for the info and links. I have been following this and hopefully nothing will come to pass

Sean

[Brunotheboxer]

How you like these apples?

[bodybump]

Originally Posted by Brunotheboxer

How you like these apples?

bruno you always come up in the most unexpected moment hahahahahahah

[Brunotheboxer]

Originally Posted by bodybump

bruno you always come up in the most unexpected moment hahahahahahah

[diablojota]

I like going without protection and patches. Oh yeah, I use an Apple!

[AIKO]

Originally Posted by diablojota

I like going without protection and patches. Oh yeah, I use an Apple!

Like barebacking. +1 on Apple

[DanP]

an apple a day keeps the virus away..... omg that was lameo sorry

[Scream]

No worries here since I'm the "Mac" Daddy!

[kyle L]

Nothing hit me today! Their probably going to hit us tomorrow when we least expect it. :(

[Oscar]

This reminds me of Chicken Little running around yelling, 'The sky is falling'.

It is now April 2 here down under and nothing has emerged or been reported on by the Media.

It's all BS................

[Mosco]

Originally Posted by Oscar

This reminds me of Chicken Little running around yelling, 'The sky is falling'.

It is now April 2 here down under and nothing has emerged or been reported on by the Media.

It's all BS................

Better safe than sorry. I apologize if I remind you of a cartoon chicken, but if one person DID get infected and I kept this (legitimately sourced) information to myself - then I would also be wrong. I am delighted to hear that you were unaffected, kudos. However, I do not appreciate being likened to a boy who cried wolf. This was on the news for the last few days and one would have reasons to believe this could have been a legitimate threat. I would rather it be a false alarm that I am ready for, then a real thing that catches me unprepared. But that's just me.

[redshirt1957]

Originally Posted by Mosco

Better safe than sorry. I apologize if I remind you of a cartoon chicken, but if one person DID get infected and I kept this (legitimately sourced) information to myself - then I would also be wrong. I am delighted to hear that you were unaffected, kudos. However, I do not appreciate being likened to a boy who cried wolf. This was on the news for the last few days and one would have reasons to believe this could have been a legitimate threat. I would rather it be a false alarm that I am ready for, then a real thing that catches me unprepared. But that's just me.

What next. "I would tell you more, but then I would have to have Bruno kill you". You guys are cracking me up.

[Mosco]

Originally Posted by redshirt1957

What next. "I would tell you more, but then I would have to have Bruno kill you". You guys are cracking me up.

Here we go....

[MrRetep]

Originally Posted by redshirt1957

What next. "I would tell you more, but then I would have to have Bruno kill you". You guys are cracking me up.

Originally Posted by Mosco

Here we go....

Got the popcorn! Now i'll just sit back and enjoy the show Anyone want some?

[MrRetep]

Im actually running a "Test" computer with no protection at the moment, Just wanna see what this thing really does. So I say bring it on!

The rest of my systems are safe and sound

[redshirt1957]

We have gone from Y2K to K-Y2U.

[junglemaster]

nothing happened to me... i think it was a prank on us

[Mosco]

Originally Posted by junglemaster

nothing happened to me... i think it was a prank on us

http://www.consumeraffairs.com/news0...orm_turns.html

[Ashley]

Greg, thank you for posting the info. There have been many conflicting reports about the validity of the claims, but either way, it's better safe than sorry, right? I appreciate it!

[Mosco]

Originally Posted by Ashley

Greg, thank you for posting the info. There have been many conflicting reports about the validity of the claims, but either way, it's better safe than sorry, right? I appreciate it!

Exactly, Ashley! Thank You for understanding - and bringing never-ending sweetness to TRF!

Fact of the matter is - this worm originally hit in January. It is a fact that it embedded itself in many, many machines, just look at this:
http://www.pcworld.com/article/15787...cker_worm.html

Worm works in such a manner that it can sit silently on a machine until it receives 'instructions' and then all hell can break loose. The original report was that it will receive new instructions on April 1st - whether true or not, as you said, better safe than sorry.

[Carolina]

I believe it's always better to be prepared. It's easy to be a Monday morning quarterback, too!

[Ashley]

Originally Posted by Mosco

Exactly, Ashley! Thank You for understanding - and bringing never-ending sweetness to TRF!

Fact of the matter is - this worm originally hit in January. It is a fact that it embedded itself in many, many machines, just look at this:
http://www.pcworld.com/article/15787...cker_worm.html

Worm works in such a manner that it can sit silently on a machine until it receives 'instructions' and then all hell can break loose. The original report was that it will receive new instructions on April 1st - whether true or not, as you said, better safe than sorry.

Ugh, this is definitely worrying! Though I checked out those sites and they all worked for me, so hopefully I'm worm free!

[Rockrolex]

There are reports that the worm tried to phone home, but no one answered.

The theory is that the hackers are lying low at the moment because so many security sites are watching that they are afraid they will get caught. They know they are dead meat if that happens. So they will either give up or try to wait till there's less chatter about it.

In any case, better to be safe than sorry.

[Mosco]

Originally Posted by Rockrolex

There are reports that the worm tried to phone home, but no one answered.

The theory is that the hackers are lying low at the moment because so many security sites are watching that they are afraid they will get caught. They know they are dead meat if that happens. So they will either give up or try to wait till there's less chatter about it.

In any case, better to be safe than sorry.

That's what I thought - but some have disagreed....

[Mosco]

Spybot Search & Destroy just terminated a process on my machine which is similar to what was described. I highly recommend the program. As I mentioned, this is not a joke, there ARE reports of infected machines.

Here's where you get Spybot from:
http://www.safer-networking.org/en/download/index.html

It is free. And sky IS falling!

[Marrk]

Not to be contrary, but how do you know that the Spybot people aren't the hackers? Or aren't infiltrated by the hackers?

Originally Posted by Mosco

Spybot Search & Destroy just terminated a process on my machine which is similar to what was described. I highly recommend the program. As I mentioned, this is not a joke, there ARE reports of infected machines.

Here's where you get Spybot from:
http://www.safer-networking.org/en/download/index.html

It is free. And sky IS falling!

[Mosco]

Originally Posted by Marrk

Not to be contrary, but how do you know that the Spybot people aren't the hackers? Or aren't infiltrated by the hackers?

Are you ?