Conficker

[DevilMayCry42]

So whats it all about?

Microsoft, Symantec and some others have released tools to remove it....So whats the big fuss about? As long as everyone updates, then nothing can happen...?

I know I'm missing something big here, as if the above were the case then there wouldn't be such a big fuss......

What am I missing?

[MadduckUK]

look where the mouse is! she's been mousing on the screen!

[kalniel]

The fact that a large proportion (majority?) of people don't stay up to date and therefore there's millions of infected computers, which while they might not infect you, might do something to a website or organisation you have dealings with.

[Salazaar]

The council I work for had a massive blitz a month or so ago when they realised that a large number of machines on the network had been infected. It took about a week to clean up and loads of our services were down at various times during the cleanup.

[Brucelles]

My company's network was hit by Conficker last time round. It was a major PITA as it prevented us using the external login, so we couldn't access the references system, or input our timesheets.

We are an IT company, and don't mess about with security or anti-malware measures, but we still got hit. It was not funny.

[smargh]

It's all about infection vectors. Conficker is a motherfracker.

Can you run to other PCs' C$ shares and create files? If yes, and you become infected, so will every PC you can run to. If one of those PCs is logged on to by a domain admin, you're fracked. If you share USB keys between PCs, both PCs are fracked. If you use basic passwords, particularly on test accounts or privileged accounts, you're fracked. If you only patch MS08-067 on all PCs, you will still be infected with the actual dodgy bits - it would just reduce a re-infection vectors on other PCs.

There are some other nifty things which Conficker does which I can't remember right now. There are various write-ups on it.

[lodore]

the solution is to patch and disable autorun.
of course its hard to do that with live equipment in a large company with regards to downtime.