Gå til innhold

Har du fått W32 conficker.* ? her er hva du må gjøre.


Anbefalte innlegg

Er spredning ute å går på en orm som heter W32 Conficker også kjent som Win32/Conficker.A , W32/Downadup.A , Conficker.A , Net-Worm.Win32.Kido.bt .

 

 

Dette er den samme ormen som slo ut over 600 maskiner hos Helse Vest i sist uke.

http://www.nrk.no/nyheter/distrikt/rogaland/1.6409246

 

 

Hva gjør ormen:

Ormen infiserer maskiner i et nettverk ved å bruke sikkerthetshull i svchost og RPC. Den kjører passord brute mot en og en maskin i nettverket for å prøve å komme seg inn på maskinen. Om ormen trenger gjennom systemet, aktiverer den kode for fjernstyring.

Skaden den gjør er, blokkering av diverse sider på nett (som omhandler virus, og fjerning av malware), blokkerer windows firewall, sletter adminpassordet og laster ned infiserte filer.

Det er også registrert treghet på maskin og nettverk.

 

Løsning:

Microsoft lanserte en fix for ormen for 2 dager siden, og en sikkerthetsoppdatering som tetter hullet ble lansert rett før jul.

 

Sikkerhetsoppdatering: Installer denne på alle maskiner i nettverket ditt. Installeres om du har fått virus, eller ikke har fått virus.

http://www.microsoft.com/technet/security/...n/ms08-067.mspx

 

Om du i tillegg er så uheldig at du har blitt infisert må du laste ned en fix som microsoft lanserte nå nettopp.

Malicious Software Removal Tool (KB890830) Kjør denne i full scan.

 

Etter at du har kjørt Microsoft fixen kjører du en fullscan med ditt eget virusprogram bare for å være på den sikre siden.

 

Dette har fungert i de fleste tilfellene hvor jeg har slettet viruset.

 

Edit: Det er blitt lagt liste over hosts hvor filangrepene kommer fra. Anbefaler å legge til denne i blocked listen i firewall:

 

 

 

aauhyeyu.info

abljahgmtt.info

abthohjx.biz

acupwlqu.com

adghitpo.info

aemhhn.cc

aerrep.biz

afptke.org

afznxhnf.ws

ahbphseqf.com

ahncdqnkmkd.cn

ahusafvr.cn

aibwwyut.biz

aimndso.info

aiwbxwx.ws

ajabkbpd.net

akpzjpl.org

alxvqlnv.net

amtdklri.net

anowwnk.cn

aobonu.net

aobslf.net

aozlexqxysh.org

apbyou.org

apleprodr.com

aprslgpkh.cn

apwppfw.info

apwxklk.cn

apxdodvvg.info

arzaoyufxqb.com

atzglghhtx.cn

auxnl.com

axitat.cc

axjxry.ws

axmtfwlzmnc.net

axugy.cn

axwocager.org

aystgpbp.com

azrsze.ws

bbflvxif.info

bbibpe.cc

bbqqszaks.ws

bbyzsuj.info

bcnjqj.ws

belbwgbg.ws

bfcrz.cc

bfixe.biz

bfjrtopqw.biz

bfqcwkvht.cn

bfxgpkcdpf.org

bhtkewtcct.ws

bjntjyadb.org

bjxatlgdl.net

bjyckjxi.info

bkejyjir.biz

bkodpabfarx.ws

bligqb.biz

blnliylvk.cn

blqjaoqfhp.ws

bltjbltv.cn

bluqppdu.net

bmklz.cn

bmwyvhdbca.org

bncxuued.info

bnjrtusx.cc

bnligodsf.org

boiaomyzop.cn

bpgui.biz

bqhkoqem.info

bqiet.ws

brgswuxf.com

brueibr.cc

bscqblq.info

bsjmltvkfc.ws

bsqgnbsts.cc

bsxhvsit.cn

bsyejqngmcu.net

btehpq.cc

burlukeevl.cn

bvblsw.ws

bvimidrxv.ws

bvmtrmt.info

bvvkibkxnbt.cn

bwpnun.net

bxcrti.info

byaqv.info

bygobihsnr.net

bzanowpav.net

cawqxlom.net

cbpvuzrrbfd.net

cbtlzcvytf.org

ccebsrsk.net

ccmuzg.cc

ccrsr.net

ccztlfyzv.com

cdmusnla.info

chodtjzomp.cc

ciezuehz.cn

ciimfe.net

cjitpd.info

ckhkq.biz

clceaafp.cc

cmvdexhz.cc

cnbldfg.info

codwzd.org

coguwfet.cc

coieupjb.cn

cpclwl.com

cpoti.cc

cpsrbjjg.com

crgwvhdblun.cn

cspgywq.cc

ctgtp.biz

ctmepeeo.com

ctxdxvjwrs.cn

cuxywqds.cn

cvqdccj.cn

cwaiwuj.net

cwlxjcljj.cn

cyejggh.biz

cymjtxmv.net

czoweodvdt.net

czssltpbqt.cn

dadlybpk.net

dbawmdvz.org

dbgluiyshvf.info

dcvubtxl.cc

dcxoyxyv.cn

ddunt.info

dfdxsuakct.ws

dffcgyk.ws

dfxyn.com

dfyhagtww.com

dgkmaqgsw.biz

dhljbscfge.info

dihfjana.biz

djlspierv.biz

djvbbc.com

dkuqaba.org

dkyrurl.com

dnqdnf.org

dovkrpgpn.ws

dpkucu.cc

dppgdotjy.com

dpqpo.net

dqcoaklr.cc

dqipybbwtnv.biz

drjpwkemg.cn

droaqlbwen.info

dvuhuspo.cn

dwswbnrltp.biz

dwzmnga.info

dxfvdadx.net

dyuaqp.org

dzacymaw.ws

dzheudjs.net

eavghrykkd.net

ebfenz.info

ecgifwim.ws

eciwgbgiwnj.cc

ecxfjlfcpv.info

eejzoanap.net

ehbiuuznegp.info

ehcsacbb.cc

ehleaprgf.biz

ehrdgootpzd.net

ehycrjwx.org

eiaasph.com

eijcqyrgvo.cn

eimlzxv.cn

eipdhl.org

eiskfbfa.cn

eityrkz.net

ekdig.ws

ekthlkpq.ws

ekvjdiudq.net

elwmycxybv.cc

embipppx.info

emyqsumuri.info

encfnzqak.cn

encoqnux.info

encvayktf.cc

enuqpslmoj.info

enyzec.ws

eonud.com

eozxxxel.cn

erfegygjc.biz

erhpwdbmagp.cn

erpkftws.org

errqfmcgidi.org

erytxve.com

espdawk.info

esrhaef.cc

etgisfxe.cn

etvdmakikg.org

eulohdok.biz

evdggjfu.info

ewhknxwq.com

ewmxsqolia.org

ewuvtehj.org

ezgcs.com

ezivhnbt.com

eztxkad.com

fayxn.cc

fbhodqelrh.org

fcnygtqggek.cc

fcseg.ws

fcysawmyon.info

fdoxvg.biz

fduhetavg.cc

feeksvfvzj.org

ffbnpzthj.info

ffvkwzear.org

fgvqkmw.net

fifdk.ws

fimusrflxz.org

fjqzcbjyt.ws

fnhqbchy.com

fooyjrqdvx.biz

fptcneb.ws

fpxyau.net

fquxj.net

fripjt.com

frqsp.ws

frrqkozf.cn

frwaqecvqk.info

fsaxfgda.info

fselxivhft.org

fsmjixdoc.com

fszpsej.biz

ftbqcdogaaj.biz

ftxtpg.cn

fvgpv.biz

fvplqgygtjf.info

fvwlgvq.net

fvxrsjtrzb.cc

fvzjvfxe.com

fwotu.net

fxdrkzarad.cn

fxebupfizyj.cc

fxkpp.biz

fxwad.cc

fybhzdldzpi.biz

fyubpto.ws

fyvbhsb.info

fyxmx.biz

galgher.org

gaxrjopu.com

gbebt.com

gbwttb.com

gcptmb.com

gdrnsuod.ws

gecwdjxca.cc

gfmifrncwy.cn

ggjdty.info

ggxkvdckye.org

giapkumytv.biz

gjlvzpscz.org

gkbqqey.info

gkmwym.org

gkuiwlcs.ws

glgtq.biz

glmfksfg.biz

gorkbiyiizg.cn

goxxqdnf.biz

gpnupkhwigk.net

gqbtuqso.cn

gqdxzae.org

gqokuwkies.biz

gqvcumy.ws

grojjjhh.net

gskdtpp.cn

gsssl.info

gssuufju.ws

gtbjmck.ws

gtgrkiv.biz

gtorwjkpmkj.com

guipkkz.biz

guykmbsv.cc

gvdfvqfaroj.org

gvfsjv.info

gvmcu.biz

gyjiyaczvh.net

gyqvmyxr.ws

hdtcfzsea.com

heomgcrxlk.info

hfrnfkfxnrs.biz

hgkeox.com

hgkxolm.cc

hgpyn.cc

hgreia.cn

hguvz.ws

hhbsyqah.net

hhnvxjdms.info

hhsydvlsi.ws

hjmrmpxaf.info

hjtpbext.info

hkmcnijdbd.com

hkmwtr.com

hllpugugkyz.biz

hlplbvg.com

hmnkamfd.cn

hmytpncbi.cc

hngxoyq.cc

howbjdwy.cc

hoyjl.cn

hpwhf.biz

hqapxc.net

hrcppyj.cn

hrypbb.info

hrzzybxm.cc

htjcvilckhz.ws

hvxdbdkvnp.com

hxgtuopbf.org

hxvyowd.info

hyldght.net

hzgtmlcp.ws

hzjrscw.org

hzklxyprny.cc

ialyt.biz

ibhvrfrn.com

ibktms.com

ibnwdcj.cn

ibqkvgwct.net

ibqxetlr.net

ibymjkbprb.org

idogoxuxdfm.cn

ifvdtrazwb.org

ihpdgjywku.com

ihukf.cc

iigqzi.cc

iiilagms.net

iimekqrp.org

iiretdxyo.org

ikceiozb.ws

ilklkc.net

imbfnnqln.org

imbkmpha.com

imdbynpprb.info

imlttmyn.com

inidutv.org

inmpaovhx.com

ioinvcw.cn

iojexwrabn.net

iopndw.org

ipgnvklb.net

ipybkqtf.com

iqjcxnzsyd.biz

isgoxvu.biz

isguakyzspd.org

ishwekhh.net

iticle.net

ivapo.com

ivaxpihcm.cn

ivcgmulb.com

iviapltjx.org

ivngaevaa.cn

ivtzaasfh.ws

ivubzho.biz

iwyvwwhjvmh.cc

ixemkrqqocv.biz

ixlhki.org

ixzvl.net

iysbbep.cc

iyxuu.net

izfdrywhln.org

jaewkkcsz.net

jainnlyar.ws

jaoxelrexk.cn

jdnukedc.org

jfbkdhgsr.ws

jfybevfhmm.cc

jgbtpcitld.org

jgcnhpdo.net

jidakfi.org

jjydznuzxu.info

jkdfcualxon.ws

jkgjztgyvqy.cn

jksrlhcqg.ws

jleikcko.info

jlqrqlzd.org

jmvaqtjzzgm.net

jmwjwrvngz.org

jnixxpqj.cn

jopvgyog.org

jqgvvnoafl.net

jrxgtdigb.info

jskrzusyq.org

jsngnvjqlxj.info

jspycafi.org

jsqincmcb.ws

jsvgaoz.com

jtfphzhj.ws

jtjhopa.org

jtpigznr.info

jtrzdmqe.ws

jtvaimtf.info

jvipi.cn

jxqzdhhb.com

jyddj.net

jymnpptjosc.cc

jyoeoxxgisa.net

jzykcdi.com

kahbin.com

kcchzp.org

kcdlnzu.biz

kckvntwlfyg.com

kcpmb.org

kdqojamlwa.ws

kedvjlyk.net

kexhqjhlpa.org

kezyvlj.cc

kftbdcwit.net

kgpzyrux.ws

kilrhckfz.ws

kinrrhw.cn

kjdovtvw.biz

kjril.biz

klfgzxlgr.cn

klqbvarlf.com

kmassdgquq.net

knicudia.ws

knprqqctn.net

kospvcjm.info

kpbldlrf.cn

kppxjk.com

kpscvvhhem.cn

kqfzwfzk.org

kqurnlqa.ws

kqwrod.org

krracamz.com

ktfadsqo.info

kuuvnhlv.biz

kvlxuv.info

kxcqkluwl.net

kxxqz.net

kykeyiuu.cc

kyvsrwjygys.biz

kyzzdv.com

kzlesmg.biz

kzofb.org

ladihnxm.info

laroqgjx.ws

laylartz.com

lbqbwmoc.com

lcegnrm.net

lcyuupdr.org

ldbyaoygbio.cn

ldpcbc.cn

leuvaybt.info

lfaasha.cc

lfzlyjrgo.cn

lfzxggfhrt.org

lhcrvyqxqsm.com

lhsmvd.biz

lhuhlxyqw.org

ljseg.cc

ljsfiewa.cn

ljuyfcto.com

llgrhtjcs.ws

loxlg.com

lplguivqdhu.cn

lprvpnjyvi.cn

lqhdavbxip.cc

lqwde.cc

lrtymxsy.info

lsgihu.ws

ltltvbqbbk.org

ltopqykza.cc

ltthxaax.net

lwbmdpqpa.ws

lwtdyntxhx.cc

lxsoctf.com

lyizvbjau.com

lyjip.info

lylaqp.net

lypusizuiam.org

lzeali.biz

lzttnwra.org

maclk.org

mcgsfexlf.info

mdtgn.ws

medpjovx.cn

mehwmyv.biz

mekwb.com

mfbxhy.ws

mfstoxfq.cn

mhlxvhfc.biz

mirxdkbat.com

mjzxybtnryy.cc

mkdjqosakje.net

mkdmmblb.ws

mkfugrbowb.info

mkgilamzvhy.org

mnihkbpr.cn

mooirknsjnf.ws

mqllpftzi.net

mqwodyisp.net

mrrdzwsz.biz

mseiehs.ws

msgvhngb.info

msjin.info

muccstfhifk.cc

mvfphewyaj.cc

mvmqaoiruvx.cc

mvzinme.cc

mwawjxjvu.net

mxcnvvjc.cn

myaet.cc

mytswi.ws

naengn.cn

nbhsznczra.info

nbrzjfer.org

nchdbsz.biz

ndjeokut.biz

neuhjydbc.net

nhitpu.info

nhnwta.cc

nklsua.cc

nkorglklie.info

nmamuvyody.net

nmftyate.com

nmgsvsg.cc

nmupsyohya.com

nmvfnuqd.net

nnbwfz.biz

nndcdoahp.ws

noblgg.cc

nogpx.ws

npphu.net

nrcrvgx.biz

nsuzsjrp.info

nszotgoftwq.com

nvcoyp.ws

nvehyoz.cn

nwewrypnnz.cc

nxdvskai.cc

nyqodexlapa.ws

nyvmchkzw.cn

nztlnkjs.biz

oavzwjxyi.ws

ocerysaf.net

ocqugzpsmn.org

oetrkuegm.org

ogesj.cc

ogtemffqbh.info

oignswwwh.org

oihlfgyq.com

oiozpzgl.com

ojlsue.org

okmdxemn.biz

okusisksljw.com

oljonqra.info

olkqcjepo.info

olydetl.biz

omaugxuplor.biz

onhmyrcnng.info

ooqxvcfl.net

oouxorzgc.ws

opsyuhqvcsg.biz

opxgkw.info

oqrlzmo.org

orqma.ws

osclnvyhmju.biz

osmbuuucc.info

oswvxnsu.cc

ouajnuxy.info

owicak.ws

oxwbv.com

ozhca.info

pagkv.cc

pbwqfnvgicw.cc

pcbqlzp.net

pdgnubwl.ws

pdkhhus.net

pemjda.info

pfscbdgc.com

pgxiinb.info

picksfxu.cc

pihgxpj.ws

pitoy.net

pkpuyjan.info

plduaxwk.org

plyheurpfy.cn

pnafwzz.cc

pnhkiwgng.cc

pqdubhp.ws

pqjao.biz

pqqhqnxo.cn

prfcsvsh.biz

prwjfnbggtm.biz

psjgiabvho.cc

pszwwlc.cc

pszzbsuv.biz

ptaqm.cn

ptwzwxvt.com

puykoqk.com

pvczx.info

pvrahvnfjip.biz

pwpbznxvqur.com

pxohbm.net

pycaio.ws

pyqpmhhj.biz

qaowlbrcvfd.cc

qbarlcifskk.org

qbexoskh.net

qbfrreobhou.org

qbpay.com

qdjxrhphdlq.cn

qdnnczuo.net

qfhud.biz

qfjcnbpa.cc

qfjiiesv.net

qfpiwhsih.cc

qjxfaqhkjlz.net

qlrfrskbj.ws

qnenxjcu.ws

qouuic.cn

qowte.com

qpjhwwyr.info

qpqhcz.net

qqalxjdexia.biz

qqncaz.com

qqoltzwr.biz

qqvcn.org

qrtymq.org

qrvcsfm.org

qrxwyavqqst.biz

qtlcuwp.net

qtvodwtk.info

quasnwelc.org

qufutdop.net

qulqekpjfk.info

qvbikosfuh.cc

qvscvpm.ws

qwfax.biz

qxfusllomoo.info

qxxrg.cc

qygyrgktwx.cn

qyszplc.ws

qytrkyps.biz

raxmxp.org

razwumwqg.ws

rbkdek.biz

rcgiabfy.info

rcjtxfgnfr.ws

rcryunjvb.ws

rdsimdru.cn

rdxggbab.com

reddhx.ws

rekpgd.cc

remoqedsr.net

repoku.biz

reugsgno.ws

rfgdfvwfi.biz

rgldfplxt.cc

rgmqqrtgpzk.org

rgqvglyyky.ws

rhfykqcgbw.biz

rhpkymwl.net

rimzapccuhz.cn

rlxpszksjn.net

rmcunldjxpi.biz

rmhofpttxdb.com

rmhppxmlrt.com

rmkrrqhy.cc

rmvwofnpmz.ws

rnzdt.ws

rofxb.net

ronqipzonze.biz

roogqzxi.biz

rpsxmu.ws

rqhxdgxq.info

rqqhh.ws

rraxmgvv.org

rrbddesawdc.ws

rsqupnsgrcr.org

rtjhehbpko.biz

rtmrjdux.info

rtojnslszq.info

ruvyhtdzdkm.info

ruybwcpy.cc

rwnzo.cn

rwzramguhj.cc

rxemnroa.cn

ryfzjsxr.info

rypisca.org

rzowqlvco.com

sapzsgwtsb.cc

sbhmyxz.ws

sdgjlmuo.info

seiewcqdhuw.cn

seqdbhv.ws

sgajhreio.cn

sgdmwirhc.biz

shgtutw.cc

shhrhyj.cn

sihgogku.com

sjkrstxz.cc

sjowwybbvyc.net

sjtgwtirmy.cc

skheohyyi.org

slvgzu.cc

smqjsji.info

smsuybkxd.cn

sorfdjqvfb.cc

sosalfgwuwp.com

srsvygdo.net

srylufga.biz

stkqoftcugr.cc

stpvfzxs.cn

suikt.org

sukpwerzi.biz

sutkjhnadta.net

suvedlyakkp.com

svavhqlq.cc

svgeltte.biz

swxnnne.net

sxcdy.org

sxvhvfsqa.ws

sxvszvpl.ws

syeppv.info

syvauwodjx.ws

syvlumcwsy.cn

szaqhkjs.net

szvcaom.info

taetpwcwby.com

taipbr.org

tavrdmbqzte.com

taxgrax.org

tcoigcnwoe.cn

tcojrjo.biz

tdcahezg.ws

teyrgpty.ws

tfkkyp.info

tfzrefdlvlo.net

tgeqsuk.cc

thfmufdu.com

tidqmcmj.cn

tijkirgk.org

tirzydpuli.ws

tjroxp.net

tjust.info

tlzyxxkm.cc

tmhizpoarzb.ws

tmqtztgf.cn

tnmgdckmdzq.ws

tokwqoj.cn

tpnjmdhnfbh.cn

tqcco.org

tqjhywcf.biz

tqnwbh.ws

tqreftcjgzm.info

ttnfzsc.biz

tulux.net

turyio.cn

tvwxa.org

twxce.cn

txdetfcwa.com

txfezhik.com

txmfrgnwwbx.com

tybmfrk.ws

tyghcenvbds.com

tyodbjboeu.com

tzqbqvdqfm.info

tzzefrz.org

uaeekggelp.com

uanpi.info

uarfbpwmmw.org

uaxdinwxj.org

ubhlzsmvai.net

ubtsanmfm.biz

uehbunp.cn

uelcdb.net

uenvvl.com

ufiwnzyl.net

ugjbgjhuwco.cc

uhbyrf.org

uikenkvje.cn

ujkomj.info

ujpsp.info

ukvxi.net

uljhju.cn

ullqmotgzyx.info

uorzvell.cn

uptymmh.net

uqmsmw.cn

uqvrwwhr.ws

usnfu.cn

uwesyssigy.org

uwkjsxdwd.net

uxcspnzl.biz

uyceq.cc

uykdlvnub.biz

uyqjzwcjlpt.biz

vaebdyhtp.info

vapevptp.com

vatdwyrp.biz

vaxdt.info

vbignapd.ws

vbiwj.ws

vdljfneyd.cn

vdtsvzqjel.org

vdwfhz.info

vetkntc.net

vfhimbw.com

vfokkrxa.ws

vgerzpwu.ws

vggdbocd.biz

vgxfltbsm.cn

vhxavkvwd.ws

vifhkuvq.info

vilmjmnxi.org

vjjomcde.biz

vkswcd.cc

vkyandlnjq.cc

vkyssp.com

vlguwtc.net

vljrxs.biz

vlnjzxkx.cc

vmdbcuiauv.cn

vmjbgbgxai.net

vmoqcghq.biz

vmoycfg.com

vmvmnoezrn.cc

vnjnr.ws

vnmgtlvuhwx.info

vnqnscnfi.org

vomvrr.net

voqrxidq.net

vpcoj.info

vqplhg.ws

vrsgjzqld.cc

vrxjsakkpx.biz

vsepzonj.cn

vsrpswbr.biz

vsvsxzru.biz

vtpqzilpu.org

vuipbzeg.ws

vuqwmpsc.ws

vuvvgidq.cn

vwmwpcs.info

vxodjkpr.cc

vyjhzmsyz.org

vzrhbx.net

vzsfiyxf.cn

vzurblra.ws

wauwfpazvy.info

wazlonadix.cn

wboeve.biz

wchgrwu.ws

wdmwqyhz.biz

wdqbnazz.org

wfivi.com

wfkxfztel.net

wfyzofgqw.net

wgbckrbnn.cc

wgekfpee.biz

wggaymksmn.cc

wgoyqqmn.cc

wgseabwc.net

wgundyjtg.cc

whtex.com

whwmqcpw.net

wkejwyfq.cn

wkhkjicf.info

wkkgf.biz

wlcsxhor.info

wlobzwe.biz

wltbaj.info

wmhevyje.info

wmoxwmye.cc

wmuvh.ws

wmuxb.net

wmvmnorzje.net

wnjykygn.cc

wnymryqmpbo.net

woitmxnq.biz

wozir.com

wpllnlvdqs.cc

wqloszgf.org

wqmqnksjq.com

wrbtcxowf.cc

wreborcs.com

wrvfzuaruhj.info

wshazbuck.cn

wslgrcxnz.com

wtzphmvw.biz

wuzth.ws

wvdwnan.com

wvmsa.info

wvngdvophf.net

wvnsgymgjvc.ws

wwcmnhy.info

wxsjsrkb.org

wzdejwwsbae.cn

wzjlsnxyaoz.biz

wztntrbrcux.ws

xbekm.com

xcandxkdzm.org

xcfjwop.net

xcnftmt.cn

xcrgsrmndh.biz

xcvka.net

xdscuercak.info

xeqjfantci.cc

xgxgg.biz

xhcvjgpm.ws

xhuwvozd.info

xiaxngbezj.net

xjhluwcx.org

xjtujsa.ws

xknjwq.cc

xladew.net

xmskw.cn

xnkckd.biz

xomovhtihzx.ws

xprvheltmoz.org

xqnafkupp.com

xrstki.biz

xsawt.info

xtdlrpl.com

xujhjyjz.org

xulhnn.biz

xunwykkv.biz

xwfdd.cn

xwfshhnko.com

xxaciwuyrda.cc

xxfknhwd.ws

xylekmr.cc

xzini.com

yayugzlypo.cc

ybgcjpnzts.info

ybnnyqhvan.biz

ybxitaql.biz

yclorj.info

yctndvxot.ws

ydswzuhtkm.biz

yeawsbub.cc

yeeollvintx.org

yeiszdkz.cn

yejibstbb.cn

yettb.cn

ygaabxla.cn

ygjdqoupy.org

yglmh.biz

ygnibsdlw.net

yhbsqbpsh.cn

yhdvyrar.net

yjrwzwck.ws

ykxcftlsv.org

ykxqjwhigme.info

ylqitlpce.org

ymbky.org

ynmovaifs.biz

ypfkzzoc.cn

yplhakjtm.org

ypqvvuwl.cc

yqnfguqz.cn

yrpdte.org

yruyarfzpf.cc

yspxvwjn.com

ytrzg.com

yufqvjdir.ws

yuvyxuxe.com

yvdctqgo.info

yvevafm.cn

ywauktyxjns.com

ywzzsgymys.biz

yxxrrq.ws

yyfnciry.biz

yykad.net

yzdmh.net

zargs.biz

zbiqa.com

zcisbmcisjt.cn

zcqkrnq.cc

zebjmyuk.info

zejtdkec.cn

ziryfppqt.com

zjhmctjkl.net

zkdqstca.com

zktqlskws.ws

zlregjxu.net

zmkkltnzivo.com

zmpde.net

znchfddd.org

zofhka.cc

zqnsstag.org

zqwxamo.cc

zsxwhktx.net

zullc.com

zveeksjykj.cc

zvklpqhgvc.ws

zwedpmoa.info

zwlbeyhyu.ws

zwxnfrlwkbg.info

zyecoevuagb.com

zyypvv.biz

zzjuk.net

 

 

 

Eksterne lenke angående ormen:

 

http://www.microsoft.com/security/portal/E...n32%2fConficker

Endret av Hille
Lenke til kommentar
  • 3 uker senere...
Videoannonse
Annonse

1r9b1k7:

Kunne du ha postet Combofix-loggen (om du kjørte denne)?

Hvis du ikke har kjørt Malwarebytes, kunne det ha vært interessant og sett om det dukker opp noe der.

 

Det er bra om verktøyet fra Microsoft faktisk gjør det det bør gjøre ang. filer og register knyttet til denne infeksjonen :)

Endret av norbat
Lenke til kommentar

Her er loggen fra malwarebytes:

 

Malwarebytes' Anti-Malware 1.33

Databaseversjon: 1713

Windows 5.1.2600 Service Pack 3

 

01.02.2009 21:38:00

mbam-log-2009-02-01 (21-37-50).txt

 

Skanntype: Rask Skann

Objekter skannet: 64376

Tid tilbakelagt: 4 minute(s), 4 second(s)

 

Minneprosesser infisert: 0

Minnemoduler infisert: 0

Registernøkler infisert: 0

Registerverdier infisert: 0

Registerfiler infisert: 1

Mapper infisert: 0

Filer infisert: 0

 

Minneprosesser infisert:

(Ingen mistenkelige filer funnet)

 

Minnemoduler infisert:

(Ingen mistenkelige filer funnet)

 

Registernøkler infisert:

(Ingen mistenkelige filer funnet)

 

Registerverdier infisert:

(Ingen mistenkelige filer funnet)

 

Registerfiler infisert:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools (Hijack.Regedit) -> Bad: (1) Good: (0) -> No action taken.

 

Mapper infisert:

(Ingen mistenkelige filer funnet)

 

Filer infisert:

(Ingen mistenkelige filer funnet)

 

 

Lenke til kommentar
  • 1 måned senere...

Har Vista Business 32-bit og mest sannsynlig Conficker. Jeg kommer inn på microssoft.com, men får ikke lastet ned MRST. Jeg har også en autorun.inf som ligner på den Conficker lager. Og rare filer rundt om kring som Symantec sin Conficker remover ikke kunne åpne.

 

Lastet ned MRST fra en annen PC, men får ikke startet den. Symantec og BitDefender sine Conficker removal tools finner ingenting. NOD32 finner heller ikke.

 

Alt er gjort i Safe Mode.

 

HJT

 

 

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 10:19:52, on 01.04.2009

Platform: Windows Vista SP1 (WinNT 6.00.1905)

MSIE: Internet Explorer v7.00 (7.00.6001.18000)

Boot mode: Safe mode

 

Running processes:

C:\Windows\Explorer.EXE

H:\HiJackThis.exe

 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =

O1 - Hosts: ::1 localhost

O2 - BHO: Java Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll

O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll

O2 - BHO: Java Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O2 - BHO: FlashFXP Helper for Internet Explorer - {E5A1691B-D188-4419-AD02-90002030B8EE} - C:\PROGRA~1\FlashFXP\IEFlash.dll

O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll

O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide

O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe

O4 - HKLM\..\Run: [PSQLLauncher] "C:\Program Files\Protector Suite QL\launcher.exe" /startup

O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [egui] "C:\Program Files\ESET\ESET NOD32 Antivirus\egui.exe" /hide /waitservice

O4 - HKLM\..\Run: [igfxTray] C:\Windows\system32\igfxtray.exe

O4 - HKLM\..\Run: [Windows Mobile Device Center] %windir%\WindowsMobile\wmdc.exe

O4 - HKLM\..\Run: [sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [intelliPoint] "C:\Program Files\Microsoft IntelliPoint\ipoint.exe"

O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background

O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun

O4 - HKCU\..\Run: [C:\Program Files\NetMeter\NetMeter.exe] C:\Program Files\NetMeter\NetMeter.exe

O4 - HKCU\..\Run: [WhatPulse] C:\Program Files\WhatPulse\WhatPulse.exe

O4 - HKCU\..\Run: [nodenable] C:\Program Files\eset\nodenable.exe

O4 - HKUS\S-1-5-19\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')

O4 - Startup: AWC (lower priority).lnk = C:\Windows\System32\cmd.exe

O4 - Startup: TK8 EasyNote.lnk = C:\Users\Stale\AppData\Roaming\TK8 Software\TK8 EasyNote\EasyNote.exe

O4 - Global Startup: Bluetooth.lnk = ?

O4 - Global Startup: Google Calendar Sync.lnk = C:\Program Files\Google\Google Calendar Sync\GoogleCalendarSync.exe

O8 - Extra context menu item: E&ksporter til Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000

O8 - Extra context menu item: Send image to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm

O8 - Extra context menu item: Send page to &Bluetooth Device... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm

O9 - Extra button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll

O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll

O9 - Extra 'Tools' menuitem: @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll

O9 - Extra button: Oppslag - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL

O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm

O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm

O13 - Gopher Prefix:

O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: Eset HTTP Server (EhttpSrv) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\EHttpSrv.exe

O23 - Service: Eset Service (ekrn) - ESET - C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe

O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe

O23 - Service: Franson GpsGate 2.0 - Unknown owner - C:\Program Files\Franson\GpsGate 2.0\GpsGateService.exe

O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe

O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe

O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\Windows\system32\stacsv.exe

O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe

O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe

O23 - Service: VAIO Event Service - Sony Corporation - C:\Program Files\Sony\VAIO Event Service\VESMgr.exe

O23 - Service: VAIO Content Metadata Intelligent Analyzing Manager (VcmIAlzMgr) - Sony Corporation - C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe

O23 - Service: wampapache - Apache Software Foundation - c:\wamp\bin\apache\apache2.2.8\bin\httpd.exe

O23 - Service: wampmysqld - Unknown owner - c:\wamp\bin\mysql\mysql5.0.51b\bin\mysqld-nt.exe

O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

 

--

End of file - 7259 bytes

 

 

 

Endret av Ståle
Lenke til kommentar

Fant http://www.skullsecurity.org/blog/?p=209

 

 

root@grete:~/nmap# ./nmap --script=smb-check-vulns --script-args=unsafe=1 -p445 -d 192.168.2.199

Warning: File ./nselib/ exists, but Nmap is using /usr/local/share/nmap/nselib/ for security and consistency reasons. set NMAPDIR=. to give priority to files in your local directory (may affect the other data files too).

 

Starting Nmap 4.85BETA6 ( http://nmap.org ) at 2009-04-01 16:36 CEST

--------------- Timing report ---------------

hostgroups: min 1, max 100000

rtt-timeouts: init 1000, min 100, max 10000

max-scan-delay: TCP 1000, UDP 1000

parallelism: min 0, max 0

max-retries: 10, host-timeout: 0

min-rate: 0, max-rate: 0

---------------------------------------------

Initiating ARP Ping Scan at 16:36

Scanning 192.168.2.199 [1 port]

Packet capture filter (device eth0): arp and ether dst host 00:30:05:65:F5:9D

Completed ARP Ping Scan at 16:36, 0.02s elapsed (1 total hosts)

Overall sending rates: 60.10 packets / s, 2524.34 bytes / s.

mass_rdns: Using DNS server 192.168.2.3

mass_rdns: Using DNS server 192.168.2.5

Initiating SYN Stealth Scan at 16:36

Scanning vaio-fedora (192.168.2.199) [1 port]

Packet capture filter (device eth0): dst host 192.168.2.3 and (icmp or ((tcp or udp) and (src host 192.168.2.199)))

Discovered open port 445/tcp on 192.168.2.199

Completed SYN Stealth Scan at 16:36, 0.01s elapsed (1 total ports)

Overall sending rates: 79.87 packets / s, 3514.10 bytes / s.

NSE: Initiating script scanning.

NSE: Script scanning vaio-fedora (192.168.2.199).

NSE: Initialized 1 rules

NSE: Matching rules.

NSE: Running scripts.

NSE: Runlevel: 2.000000

Initiating NSE at 16:36

Running 1 script threads:

NSE (0.302s): Starting smb-check-vulns against 192.168.2.199.

NSE: SMB: Extended login as \guest succeeded

NSE: SMB: Extended login as \guest succeeded

NSE: SMB: Extended login as \guest succeeded

NSE (0.463s): Finished smb-check-vulns against 192.168.2.199.

Completed NSE at 16:36, 0.16s elapsed

NSE: Script scanning completed.

Host vaio-fedora (192.168.2.199) is up, received arp-response (0.0013s latency).

Scanned at 2009-04-01 16:36:09 CEST for 0s

Interesting ports on vaio-fedora (192.168.2.199):

PORT STATE SERVICE REASON

445/tcp open microsoft-ds syn-ack

MAC Address: 00:1F:3B:0B:F3:A1 (Intel Corporate)

 

Host script results:

| smb-check-vulns:

| MS08-067: FIXED

| Conficker: Likely CLEAN

|_ regsvc DoS: ERROR: NT_STATUS_OBJECT_NAME_NOT_FOUND

Final times for host: srtt: 1341 rttvar: 3920 to: 100000

 

 

Read from /usr/local/share/nmap: nmap-mac-prefixes nmap-services.

Nmap done: 1 IP address (1 host up) scanned in 0.71 seconds

Raw packets sent: 2 (86B) | Rcvd: 3 (126B)

 

 

 

Men kommer ikke inn på eset.com, laste ned oppdateringer til windows/defender eller WLM.

 

når jeg pinger eset.com, oversetter noe det til 127.0.0.1.

 

 

C:\Users\Stale\Desktop>nslookup eset.com

Server: UnKnown

Address: 192.168.2.5

 

Non-authoritative answer:

Name: eset.com

Address: 72.3.254.86

 

 

 

 

LØST: ComboFix fikset det. Men det ser ikke ut som det var Conficker. Jeg vet ikke hva det var, men vil gjerne finne det ut:

https://www.diskusjon.no/index.php?showtopic=1093708&hl=

Endret av Ståle
Lenke til kommentar
  • 3 uker senere...

Muttern fikk mail fra Nextgentel med beskjed om at hun var infected med Conficker viruset her om dagen. Jeg har scannet pc'en med både Microsoft malicious software removal tool, S.T.I.N.G.E.R har kjørt Combofix uten at de har funnet noe :-/

 

Noen som har peiling på hvordan jeg kan finne ut med sikkerhet om denne maskinen har conficker`?

 

Edit: la til combofixloggen hvis det kan være til hjelp :)

combofix_log.txt

Endret av turb0man
Lenke til kommentar

Opprett en konto eller logg inn for å kommentere

Du må være et medlem for å kunne skrive en kommentar

Opprett konto

Det er enkelt å melde seg inn for å starte en ny konto!

Start en konto

Logg inn

Har du allerede en konto? Logg inn her.

Logg inn nå
×
×
  • Opprett ny...