W32/Conficker.worm

Surprise!

The critics will say: you should have known this would happen. Some people think Windows is a fighting word when you use it in relation to web servers. Well I don't:) If you use some ASP or .Net stuff, you're bound to end up in that street.

So last week, Microsoft issued some new updates to the W2k3 os. I never install this stuff directly on production network, call it precaution or bad luck but I always end up to be the one that has problems with new stuff.

Since I've tested the updates first on the test network, I had something like "what the heck, let's go ahead, right?"

So I want to surf to the microsoft website and I get this "Unable to connect" message. My bell doesn't ring directly, the DNS might be down or somethin'... So I hop nameservers... Nothing there:)

So there it was, my very first production infection. Everything works smoothly but nothing seems to be able to update. Not the windows itself, not the expensive anti-virus I'm running.

After a bit of websurfing, I come down to this site:

https://kc.mcafee.com:443/resources/sites/MCAFEE/content/live/CORP_KNOWLEDGEBASE/60000/KB60909/en_US/Combatting_W32_Conficker_worm.pdf

So some smart guys with too much time on their hand managed to write this really sticky worm that hangs onto some vital windows services and reproduces flawlessly over SMB-shares.

Pretty smart, huh?

After multiple hours of virus scanning, rebooting and "hotfixes", everything was back to normal.

The solution is time-consuming but in fact quite simple:

-You need security update MS08-067 installed on your system. This is included in even the first service pack of Win2k3 (and is a included package in Win2k8 or Win7 so there you shouldn't worry too much - if the rest of the terms are met, that is - which wasn't the case with my production network).

- Once you've got the hotfix active, just run your full system scan as much as necessary.

- Follow the extra protection steps found in the useful PDF on the McAfee website.

That should do the trick. But there's more to it. Since this virus is network-aware (only on the presentation-layer), you need to be sure about who and what you give access to your SMB-shares. I see a lot of people opening network shares to "Everyone" with RW-permissions, this is ot something you want to do! It will certainly spread worms around without you even knowing about it. In that case, if you haven't scrongly secured every single end-device on your network, it is bound to get infected.