Perimeter

Guest Blog // Selected Security Content Provided By Sophos
What's This?
4/2/2009
07:13 AM
Graham Cluley
Graham Cluley
Security Insights
50%
50%

A Quick And Easy Way To Tell If You're Infected With Conficker

Even though April 1st is now history, you would be foolish to think the Conficker worm is no longer a problem. It's still out there, still causing a nuisance, and could be instructed to activate a payload whenever the hackers choose. So what you want is a quick and easy way to tell if you might be infected, right?

Even though April 1st is now history, you would be foolish to think the Conficker worm is no longer a problem. It's still out there, still causing a nuisance, and could be instructed to activate a payload whenever the hackers choose. So what you want is a quick and easy way to tell if you might be infected, right?Well, the good news is that besides the myriad of free Conficker removal tools that antivirus companies have come up with, a guy named Joe has come up with something beautiful, simple, and neat that doesn't involve you installing any software at all!

Joe Stewart is the director of malware research at SecureWorks, and he has created a neat Web page that instantly and visually tells you if you're likely to be infected by the Conficker worm.

It works by presenting a page of Website logos. Because the Webpage drags down images of Websites that are blocked by the Conficker worm (to prevent you from visiting computer security Websites, for instance), it can diagnose the likelihood of your PC being infected.

Of course, you can't check all of your computers with Joe's method. Given that Conficker has network- and USB-spreading capabilities, a lot of PCs will be infected that don't have an Internet connection. And it's always possible that a new strain of Conficker comes out that his page doesn't know about, or that other connectivity problems could give you a false impression of the status of your PC.

Even so, it's genius in that way that the most wonderfully simple things always are. I love it.

Graham Cluley is senior technology consultant at Sophos, and has been working in the computer security field since the early 1990s. When he's not updating his other blog on the Sophos website you can find him on Twitter at @gcluley. Special to Dark Reading.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Government Shutdown Brings Certificate Lapse Woes
Curtis Franklin Jr., Senior Editor at Dark Reading,  1/11/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
The Year in Security 2018
This Dark Reading Tech Digest explores the biggest news stories of 2018 that shaped the cybersecurity landscape.
Flash Poll
How Enterprises Are Attacking the Cybersecurity Problem
How Enterprises Are Attacking the Cybersecurity Problem
Data breach fears and the need to comply with regulations such as GDPR are two major drivers increased spending on security products and technologies. But other factors are contributing to the trend as well. Find out more about how enterprises are attacking the cybersecurity problem by reading our report today.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-6443
PUBLISHED: 2019-01-16
An issue was discovered in NTPsec before 1.1.3. Because of a bug in ctl_getitem, there is a stack-based buffer over-read in read_sysvars in ntp_control.c in ntpd.
CVE-2019-6444
PUBLISHED: 2019-01-16
An issue was discovered in NTPsec before 1.1.3. process_control() in ntp_control.c has a stack-based buffer over-read because attacker-controlled data is dereferenced by ntohl() in ntpd.
CVE-2019-6445
PUBLISHED: 2019-01-16
An issue was discovered in NTPsec before 1.1.3. An authenticated attacker can cause a NULL pointer dereference and ntpd crash in ntp_control.c, related to ctl_getitem.
CVE-2019-6446
PUBLISHED: 2019-01-16
An issue was discovered in NumPy 1.16.0 and earlier. It uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object, as demonstrated by a numpy.load call.
CVE-2019-6442
PUBLISHED: 2019-01-16
An issue was discovered in NTPsec before 1.1.3. An authenticated attacker can write one byte out of bounds in ntpd via a malformed config request, related to config_remotely in ntp_config.c, yyparse in ntp_parser.tab.c, and yyerror in ntp_parser.y.