Topic: Conficker C is scary as hell

[Clive]

http://mtc.sri.com/Conficker/addendumC/index.html

conficker C represents a best-of-breed specimen of malware, with its swiss-army-knife-from-hell approach to digging in, staying hidden, and making your life generally miserable. Telltale symptoms: you can't view such web sites as Microsoft.com, symantec.com, avast.com, or any other computer security-related sites the worm authors have thought to include in the blacklist; you can't run any of the superb Sysinternals utilities, or many other utilities, because they get killed within a second of starting them up; your antiviral software is impotent. But none of that is the point of the worm.

more about conficker C

[Simon]

[davy51]

getting rid of this one will be a hard job it you get it on your computer

[Rik]

And yet they rate it 'medium'. 

[Clive]

Last week F-Secure alerted me to the fact I had acquired the virus trojandownloader.win32.agent.blcq .  Spybot also showed a number of possibly related trojans which were easily removed.  However, the virus had disabled system restore and F-Secure updates.  It also prevented me from running F-Secure in Safe Mode and it took several further scans to remove it.  I've carried out a number of scans since and it seems to have disappeared. 

[Simon]

No security is 100% foolproof, but it's a shame F-Secure didn't block the virus before infection, Clive.  Unless, of course, it was there as a 'timebomb', before you installed F-Secure. 

[Clive]

It turned up several weeks after I installed F-Secure.  I don't know why it didn't block it but I know I received it via an e-mail. 

[Simon]

I assume you have email scanning on?  It should be, by default.

[Clive]

Yes I do and it did nothing about it.  But my e-mails are pre-scanned by Symantic and I was warned by them that the e-mail - from a trusted source - contained the virus.  I  viewed the contents on the server and deleted it instead of downloading it into Outlook Express since I thought that would be safe enough.  But at the next scheduled scan F-Secure detected the virius and offered to deal with it suggesting that the best remedy was to allow it to rename it.  A second scan showed the virus was still there and this time I told it to repair.  That failed to remove it so that it when I tried system restore, safe mode and updating etc.  However, a third (or fourth) attempt to remove it did the trick.  I'm now running a scan every couple of days just to check it hasn't resurfaced.  Spybot scans clean so I'm encouraged to believe that it really has been nuked. 

[Simon]

Very strange, Clive.  I don't understand how a virus could be activated from an email when only viewed on the server, as, at that point, nothing has been downloaded to your machine.  I have been using F-Secure since 2005, and nothing has ever got past it.  In fact, the one and only time I have had an infection, was when I was still using Norton!  I can only guess you were very unlucky, and the virus slipped through before F-Secure's scheduled update downloaded the definitions to protect you from it.  At least you seem to have got rid of it, thankfully.

[Clive]

Yes, all's well that ends well as the Bard said.   

[sam]

I'm not going to go for the old linux argument but gosh it does make your life easier! :-D

[Simon]

In some ways, I can see that it does.  I'd actually seriously consider looking at an iMac as my next computer.

[sam]

I'm writing from my powerbook write now... still though Mac OS X doesn't cut it compared to Ubuntu in my opinion...

[Simon]

Would you concede it to be a happy medium though, Sam?