Slashdot Mirror
Conficker Blamed In $72M Scareware Ring
tsu doh nimh writes with an update on the previously mentioned crackdown on scammers peddling fake antivirus products, who were apparently taking advantage of the worm that just won't go away: "Police in Ukraine said the thieves fleeced unsuspecting consumers with the help of the infamous Conficker worm, although it remains unclear how big a role the fast-spreading worm played in this crime. Interestingly, the picture showing the stack of PCs confiscated by Ukrainian authorities (SBU) in this raid is identical to the one shown in an SBU press release last fall, when the SBU detained five individuals connected to high-profile ZeuS Trojan attacks."
the governments they seem to be truly angry at and bring them down? I'm curious is there any virus or network that is exclusively targeting governments rather than average consumers that are ill informed or unfortunate to click and install some otherwise obvious infection?
Those 2 pictures are the same stacks, in the same room, just with the camera rotated 90 degrees ...
The problem with slashdot is that most of its users were bullied and stuffed into lockers as kids!
This a really nasty piece of malware that actually prevents you from reaching any security-related sites.
This was also the impetus for my finally moving from XP to Ubuntu full-time.
Word for the wise: after you run a standard battery of antivirus programs, you should also run conciller.exe . That's the only way to get rid of it for good. Otherwise it embeds itself into system files and re-emerges even after you apply a service pack.
More here.
I'm not a lawyer, but I play one on the Internet. Blog
The pictures they claim show evidence are the same as an earlier picture showing evidence against someone else. I think we can safely ignore whatever the police say, at least in this case.
Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
I don't think that's up to us, but to Ukraine's applicable court to judge evidence.
that's not a good idea.
first of all some windows versions have problems with huge hosts files and it can actually slow down the computer.
secondly, its probably trivial for a virus to bypass it.
also, they constantly use new domains and adresses.
it might be better to use a real firewall like the one built in router
another option is using some free DNSs that also block malware sites. (if you can trust them)
but, as always, linux is the best option in the end..
You're overlooking to turn off the DNS Client Cache Service with relatively speaking LARGER hosts files!
"first of all some windows versions have problems with huge hosts files and it can actually slow down the computer." - by Anonymous Coward on Saturday June 25, @11:13AM (#36568282)
Cure's above what I quote from you, guaranteed...
I do it myself - have to: 1,457,748++ line item entries in my HOSTS file, mostly adbanners blocked (for speed, gain is huge & noticeable) & for security vs. malware + botnets (blocking known bogus servers/sites/hosts-domains)
I.E.-> The DNS Client Cache Service in Windows' structure that gets loaded is NOT "flexible" like say, a list construct or dynamic array...
In fact?
I pointed that which you speak of, to a Microsoft mgt. person (Senior VP, Windows Client Performance Division) named Foredecker (Mr. Richard Russell) who posts here in fact. asking for a "fix/patch", here:
http://slashdot.org/comments.pl?sid=1467692&cid=30384918
(He also admitted after a bit of a debate on it also, that another idea I had was correct either... see the bottom-most part of that link above)
---
"secondly, its probably trivial for a virus to bypass it" - by Anonymous Coward on Saturday June 25, @11:13AM (#36568282)
Here's a few things vs. that I do:
---
1.) I use ACL & write-protect of the HOSTS file (granting system access & myself)
2.) Mine HOSTS file's CONSTANTLY updating via the system for it I mention now in reply (& there are others, HOSTSMAN for example over @ MVPS.org, & I even built another in Delphi 2002-2009 earlier still, & used it (PyThon now though, write-once, run anywhere IS why))
3.) Once you "blockout" known sources for that kind of thing, you can't get infested as easily IF @ all (& antivirus/antispyware take over the rest via heuristics options or their base signatures/mugshots of "known offenders", so-to-speak).
---
Here's a testimonial example to that effect beyond my own here from other slashdotters in fact to that very effect:
"Ever since I've installed a host file (http://www.mvps.org/winhelp2002/hosts.htm) to redirect advertisers to my loopback, I haven't had any malware, spyware, or adware issues. I first started using the host file 5 years ago." - by TestedDoughnut (1324447) on Monday December 13, @12:18AM (#34532122)
---
And, there you are... "Layered Security" is the way...
(I am *SURE* I noted that above... again, did you read my post in its entirety I must ask?)
---
"also, they constantly use new domains and adresses." - by Anonymous Coward on Saturday June 25, @11:13AM (#36568282)
Which I fill here as they are discovered... that's the way it works in most all security!
(I.E.-> Reactive in nature, MOSTLY, as is the case in antivirus/antispyware programs also)
Here though? Again - That goes on & every 15 minutes from 15 diff. reputable & reliable sources via a Python system for that here... constantly updated!
(I *think* I noted this in my init. post you replied to now also...)
---
"it might be better to use a real firewall like the one built in router " - by Anonymous Coward on Saturday June 25, @11:13AM (#36568282)
I do, & I noted that...
In fact, I combine HOSTS with Norton DNS (which again, uses DNSBL vs. malware etc.), software firewalls, AND, a Linksys NAT stateful packet inspecting router.
(I must ask once more - Did you read the entirety of my post?)
---
"another option is using some free DNSs that also block malware sites. (if you can trust them)" - by Anonymous Coward on Saturday June 25, @11
NortonDNS was the topic of another post I did here http://yro.slashdot.org/comments.pl?sid=2268288&cid=36567596 and in the one you replied to fellow ac?
I didn't note about my HOSTS file update "automagically" system in Python, nor it updating every 15 minutes... my bad, sorry, correcting for it now!
APK
P.S.=> Too many things going on here today on Sat. a.m., doing garden & yard work, paying bills, & posting on slashdot too? My brain needs a faster & multi-core CPU upgrade, lol... not multitasking well enough!
... apk
http://yro.slashdot.org/comments.pl?sid=2268432&cid=36567794
Whoever downmoderated my post should have the courage to speak their mind on reasons for downmoderating my post, based on errors in technical information in computing.
(Additionally, should said "courageous hero" (lol, not) have the balls to reply? Do so... & not just some silly vendetta, or being a troll with off-topic adhominem attacks - do so based on what you feel is in error in my posting (IF You can)).
I suppose I can be happy you're blowing them that way though, & wasting them.
* In any event? See subject-line, & thank you!
APK
P.S.=> I mean, lol, hey: If the "best you've got" is hit & run down moderations of a post, then you've made my point(s) above!
Otherwise? I can only suspect that some malware maker/botnet master is behind the wheel of this unjust downmoderation. ... apk
"?dlrow elttil laiceps nwo ruoy ni ereht nuf hcum taht gnivah yllaer uoy erA" - by Anonymous Coward on Saturday June 25, @04:15PM (#36570730)
?
APK
P.S.=> I don't think the ac troll replier understood my question, & I certainly do NOT understand his answer... someone get me a translation please... lol!
... apk