Thread: Worst virus in years infects 6.5 mn computers

Worst virus in years infects 6.5 mn computers

A computer virus attack that has infected more than 6.5 million Windows PCs this week is one of the worst in years, internet security firm F-Secure said Friday.

In total the worm, which is known as Downadup or Conficker, has infected nearly nine million PCs since its first version was unleashed two years ago.

'The number of Downadup infections (is) skyrocketing,' Toni Koivunen, an F-Secure researcher, said in an entry to the company's security lab blog. 'From an estimated 2.4 million infected machines to over 8.9 million during the last four days. That's just amazing.'

Computer users have little to fear if they keep their computers patched with the latest Microsoft security fixes, but Microsoft says that at least one third of PCs have not yet been updated.

Microsoft says the worm exploits a bug in the Windows Server service used by Windows 2000, XP, Vista, Server 2003 and Server 2008.

The worm works by searching for a Windows executable file called 'services.exe' and then becomes part of that code. Once it's embedded in a PC, Downadup generates a list of possible domains, selects one, then uses that domain to reach a malicious server from which it downloads additional malware to install on the hijacked computer.

The latest version of the virus is particularly nasty since it uses a complicated algorithm to create hundreds of new domains, making it much harder for security experts to shut it down.

wow , thats some number to worry about...

what are its symptoms, how to find out if it has infected my system?

Originally Posted by hitesh.07

what are its symptoms, how to find out if it has infected my system?

SYMPTOMS:
Connection times out while trying to access various antivirus related websites.
Windows Update has been disabled.
Presence of autorun.inf files in the root of mapped drives pointing to a .dll file inside the RECYCLER folder of the drive.

Refer to remove it :

Win32.Worm.Downadup.Gen

Microsoft Security Bulletin MS08-067 – Critical: Vulnerability in Server Service Could Allow Remote Code Execution (958644)

i have installed that patch, thanks for the bulletin link

Originally Posted by hitesh.07

i have installed that patch, thanks for the bulletin link

Always welcome.

i am happy to annouce that my pc is officially infected with confliker virus.my nod32 says it quarentinned it.:38:

Keeping windows, AV softwares updated and configuring the TCP half open connections to something between 50 and 100 should help the commoners to escape from this worm.

this worm can not enter your system if you got a good and updated version of internet security software, most of the anti virus softwares can detect and kill this.

If you are using Genuine Windows, then always keep your system is up-to-date with Microsoft updates.

Otherwise use a good antivirus and keep it up-to-date, to prevent yourself from theese kind of threats.

Originally Posted by DM111PUSP

If you are using Genuine Windows, then always keep your system is up-to-date with Microsoft updates.

Otherwise use a good antivirus and keep it up-to-date, to prevent yourself from theese kind of threats.

I'd recommend that you do both: Upgrade Windows + Use good Security Software.