Conflicker

[tlapinski]

Any computer guys know anything about this? I had never heard of it until my fiance's boss started to go into panic mode over it. He plans to unlplug his server at work the day before and wait until he hears it is ok to go back online on the 1st. Someone he knows at his local coffee hang out that is "in the know" set him in a frenzy. Is this Y2K madness all over again?

http://hi-tech-consulting.com/blog/?p=190

http://chattahbox.com/technology/200...off-april-1st/

[striperman36]

It could happen. This malware stuff is beyond malicious. Day 0 stuff can kill anyone no matter how protected you are.
Our security guys are losing sleep over this or I should say our security guys never sleep.

[fishy07]

Originally Posted by striperman36

It could happen. This malware stuff is beyond malicious. Day 0 stuff can kill anyone no matter how protected you are.
Our security guys are losing sleep over this or I should say our security guys never sleep.

So what can the average person or small business do to protect themself? Not turn on their computer that day or could it attack you in the days that follow? I'm not the smartest person when it comes to computers

[Striperknight]

Run all the MS updates on your servers.

[The Dad Fisherman]

Backup your files for starters....

and if the FBI, MIT and other security companies can't figure out how to stop it.....well.....I would shut off my PC and go fishing.

[Striperknight]

I missed plugfest because of conflicker.

[Striperknight]

I swear if I ever meet the guy who created this........:cens :

[MrHunters]

updated patches and antivirus you should be good.

virus guys exploit an MS vulnerablity. MS releases a patch... and repeat.

they are 16 year old russians making this chit and are regarded as heros.

[bloocrab]

Anyone run into an issue with the Removal Tool not being able to remove an infected file?

We've installed the patch MS08-067, ran the Removal Tool from Symantec ...but it keeps detecting a file that it says it will delete after a reboot, but after a rescan, the infected file is still there?


Gotta do some more research ....

[bloocrab]

Has anyone successfully removed it?

I thought I did, 2 days later...it's BAAACK!!!

ANY HELP is GREATLY appreciated!!!!

[Saltheart]

I had a virus , it had an okh extension and was called a Trojan horse by the AV software but it did not specify it was conflicker. I had to jump through hoops to get it out. Do a serach for *.okh and if you got it you can read how I got it out under the "best firewall" thread. I suppose the same method should work on any virus as long as you have an AV program that has the virus signature.

[bloocrab]

*** ...but as long as you have an AV program that has the virus signature

Saltheart, sorry for the late reply.,,,no okh extension, strictly junk dlls, items in a bogus Recycler folder and new registry entries/edits, and if that's not enough, ,,bogus Services were created.....but you hit the nail pretty square on the head with the anti-virus needing to be up to par.,,


For anyone still suffering from this mess, (like me ) I ran the Symantec removal tool "D:exe" (located on their site for free) ....installed the patch from MS but couldn't get rid of the file that it was supposed to delete after a reboot...(a weird named,, dll file), each workstation had a different one, so you couldn't just search for the same one. ...but anyway,, The log file that the tool creates displays the location of the junk dll, (uncheck "hide protected operating system files" under your folder options) within the system32 folder, take ownership of the file and then manually delete it. Do all of this in safe mode. Sometimes the tool does delete the file, but if it says it will delete it after the next reboot, it never did. I then emptied the recycle bin, and installed the patch, rebooted...re-ran the scan and it came back clean.

However, I thought the patch was supposed to keep it out, it does NOT!

*** I'm currently battling with my anti-virus company because they're having difficulties disinfecting or quarantining it...so it keeps on coming back, when you're dealing with shared drives throughout the network, a virus that LOVES thumb/flash drives....woah what a mess!!!...
It's been quite the adventure...It's on over 600 workstations and 10 servers....God only knows how many thumb drives it's taken residence on....

I'm hoping once my anti-virus can contain it, I can catch up........until then....


Any advice or comments are GREATLY welcome.