Giant Internet worm set to change tactics April 1 (AP)

[ducks]

http://tech.yahoo.com/news/ap/20090327/ap_on_hi_te/tec_conficker_countdown

[France B-boy]

Stop Conficker from spreading by using Group Policy

Notes

This procedure does not remove the Conficker malware from the system. This procedure only stops the spread of the malware. You should use an antivirus product to remove the Conficker malware from the system. Or, follow the steps in the "Manual steps to remove the Conficker.b variant" section of this Knowledge Base article to manually remove the malware from the system.
Please carefully read and understand the note in step 4 of this procedure.

Create a new policy that applies to all computers in a specific organizational unit (OU), site, or domain, as required in your environment.

To do this, follow these steps:

Set the policy to remove write permissions to the following registry subkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost
This prevents the random named malware service from being created in the netsvcs registry value.

To do this, follow these steps:

Open the Group Policy Management Console (GPMC).
Create a new Group Policy object (GPO). Give it any name that you want.
Open the new GPO, and then move to the following folder: Computer Configuration\Windows Settings\Security Settings\Registry
Right-click Registry, and then click Add Key.
In the Select Registry Key dialog box, expand Machine, and then move to the following folder: Software\Microsoft\Windows NT\CurrentVersion\Svchost
Click OK.
In the dialog box that opens, click to clear the Full Control check box for both Administrators and System.
Click OK.
In the Add Object dialog box, click Replace existing permissions on all subkeys with inheritable permissions.
Click OK.

Set the policy to remove write permissions to the %windir%\tasks folder. This prevents the Conficker malware from creating the Scheduled Tasks that can re-infect the system.

To do this, follow these steps:

In the same GPO that you created earlier, move to the following folder: Computer Configuration\Windows Settings\Security Settings\File System
Right-click File System, and then click Add File.
In the Add a file or folder dialog box, browse to the %windir%\Tasks folder. Make sure that Tasks is highlighted and listed in the Folder: dialog box.
Click OK.
In the dialog box that opens, click to clear the check boxes for Full Control, Modify and Write for both Administrators and System.
Click OK.
In the Add Object dialog box, click Replace existing permissions on all subkeys with inheritable permissions.
Click OK.

Set ######## (Autorun) features to disabled. This keeps the Conficker malware from spreading by using the ######## features that are built into Windows.

To do this, follow these steps:

In the same GPO that you created earlier, move to one of the following folders:

For a Windows Server 2003 domain, move to the following folder: Computer Configuration\Administrative Templates\System
For a Windows 2008 domain, move to the following folder: Computer Configuration\Administrative Templates\Windows Components\######## Policies

Open the Turn off ######## policy.
In the Turn off ######## dialog box, click Enabled.
In the drop-down menu, click All drives.
Click OK.

Disable the local administrator account. This blocks the Conficker malware from using the brute force password attack against the administrator account on the system.

Note Do not follow this step if you link the GPO to the domain controller's OU because you could disable the domain administrator account. If you have to do this on the domain controllers, create a separate GPO that does not link the GPO to the domain controller's OU, and then link the new separate GPO to the domain controller's OU.

To do this, follow these steps:

In the same GPO that you created earlier, move to the following folder: Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options
Open Accounts: Administrator account status.
In the Accounts: Administrator account status dialog box, click to select the Define this policy check box.
Click Disabled.
Click OK.

Close the Group Policy Management Console.
Link the newly created GPO to the location that you want it to apply to.
Allow for enough time for Group Policy to update to all computers. Generally, Group Policy replication takes five minutes to replicate to each domain controller, and then 90 minutes to replicate to the rest of the systems. A couple hours should be enough. However, more time may be required, depending on the environment.
After the Group Policy has propagated, clean the systems of malware.

To do this, follow these steps:

Run full antivirus scans on all computers.
If your antivirus software does not detect Conficker, you can use the Malicious Software Removal Tool (MSRT) to clean the malware. For more information, visit the following Microsoft Web page: http://www.microsoft.com/security/malwareremove/default.mspx (http://www.microsoft.com/security/malwareremove/default.mspx)
Note You may still have to take some manual steps to clean all the effects of the malware. To clean all the effects that are left behind by the malware, follow the steps that are listed in the "Manual steps to remove the Conficker.b variant" section of this Knowledge Base article.


http://support.microsoft.com/library/images/support/kbgraphics/public/en-us/uparrow.gifBack to the top (http://support.microsoft.com/kb/962007#top)

[LnGrrrR]

I'm not going to that link because it's probably just the link for the virus ;)

[ClingingMars]

lol, windows

[baseline bum]

Linux is looking pretty good right now.

[TDMVPDPOY]

fuck that shit if alot of instructions, fuck it

[Cant_Be_Faded]

Anyone watch 60 minutes tonight? Before the lebron interview they did a thing about Conficker. They had their really really old blonde interviewing Symantec antivirus president....she was describing what it's like to get infected, and was clicking on malicious websites...she said this

"And then I get infected. The hackers, have owned me."

L O L

[baseline bum]

Anyone watch 60 minutes tonight? Before the lebron interview they did a thing about Conficker. They had their really really old blonde interviewing Symantec antivirus president....she was describing what it's like to get infected, and was clicking on malicious websites...she said this

"And then I get infected. The hackers, have owned me."

L O L

LOL... that piece was a big fucking commercial for Symantec.

[Cant_Be_Faded]

LOL... that piece was a big fucking commercial for Symantec.

No shit. And I loved how they barely touched on the conflict of interest. And I got pissed off how they mentioned Russia's cyber army and not the fucking chinese. Don't they realize the Chinese have 40 million people in their cyber army that are forced to hack at gunpoint?

[baseline bum]

I hate how the word hacker has become so bastardized by popular culture. A hacker is an expert programmer; not some 12 year-old douchebag copying something he read online to try to steal credit-card numbers or install a rootkit on someone's system.

[Cant_Be_Faded]

I hate how the word hacker has become so bastardized by popular culture. A hacker is an expert programmer; not some 12 year-old douchebag copying something he read online to try to steal credit-card numbers or install a rootkit on someone's system.

I laughed my ass off when they showed that 12 year old Russian neonazi skinhead "Hacker" in that photo, and they did not mention how he was grabbing that other dude's dick, giving the thumbs up with his other hand.
Did you see this? The guy was grabbing the other skinheads crotch, and the whole crew was giving the thumbs up. And all the old chick said was, "He's a hacker? He can't drive!"

[baseline bum]

I laughed my ass off when they showed that 12 year old Russian neonazi skinhead "Hacker" in that photo, and they did not mention how he was grabbing that other dude's dick, giving the thumbs up with his other hand.
Did you see this? The guy was grabbing the other skinheads crotch, and the whole crew was giving the thumbs up. And all the old chick said was, "He's a hacker? He can't drive!"

:lol I didn't notice that!

[Cant_Be_Faded]

It was like a michael jackson crotch grab, except the little kid was doing it to the other skinhead in the middle.

[mouse]

Symantec antivirus

Anyone who still uses that dinosaur of a software deserves an infection..