Slashdot Mirror

Yesterday the Conficker Working Group saw 634 million HTTP hits on Conficker domains from 1.7 million unique IP addresses. This is seems to be a fairly static figure going on three years now.

Against a background of billions of rooted Windows boxen it would be such a faint sound that it would be lost in the din. At last count just one Windows botnet - Conficker - was probing the Internet from 630 million unique IPv4 addresses, or more than one seventh the theoretical total possible number of IP addresses - down from 700 million. Conficker is just one of dozens of botnets.

I guess the lesson here is that if your network is accepting communications from the public Internet, if your server is accepting communications from your intranet and not assuming that every address it's responding to is compromised, you're doing it wrong. The network is an untrusted space - always.

Not sure how effective this really is, but it makes sense.

http://www.confickerworkinggroup.org/infection_test/cfeyechart.html

? Did they even put up a page where you can check yourself or your network?

Yes

Is there a way for the researchers to use the sinkhole to clean the worm?
 

Probably not.

But YOU CAN HELP:

Just Click the the CornFlicker Eye Chart to test your machine:

http://www.confickerworkinggroup.org/infection_test/cfeyechart.html

You can read about it in the link posted in TFA.

In case anyone's wondering: http://www.confickerworkinggroup.org/wiki/pmwiki.php/ANY/InfectionTracking

The nmap based tools obviously aren't the right tool for the "clueless parents/noobs/whatever" case. If you have a large number of machines to check and at least one competent person, use nmap. If you need to test a noob's box over the phone, just have them open the Conficker eyechart and tell you whether the images load or not.

On a side note, that eye chart the Conflicker Group had up no longer works.

http://www.confickerworkinggroup.org/infection_test/cfeyechart.html

Works for me.

also it looks like http://www.confickerworkinggroup.org/ [confickerw...ggroup.org] is down

I can still get to it... you must be infected!

(Ok, ok, i'm just joking, it doesn't load for me either. It seemed a lot funnier when i first started typing it :P )

On a side note, that eye chart the Conflicker Group had up no longer works.

http://www.confickerworkinggroup.org/infection_test/cfeyechart.html

also it looks like http://www.confickerworkinggroup.org/ is down

While doing a bit of looking around for another post in this thread I found what's basically an idiot's guide to detecting conficker. It uses pictures to show you if you have it.

This tickled my funny bone for some reason; you have to love the lets-use-pictures approach!

Yeah, you need to be a real expert to run AVG, or go to this website:
http://www.confickerworkinggroup.org/infection_test/cfeyechart.html

Conflicker can be removed, and should be.

As someone who has had a PC for pretty much the entire history of the PC, I have never had a virus on an IBM Compatible.

So I wonder how bad it really is.