Our school get annoying worm which cause slow internet connection and make it dificult to access major anti virus website. Finally we found out the name :
- Worm.Conficker [PCTools]
- W32.Downadup [Symantec]
- Net-Worm.Win32.Kido.ih [Kaspersky Lab]
- W32/Conficker.worm [McAfee]
- W32/Confick-A [Sophos]
- Worm:Win32/Conficker.A [Microsoft]
- Worm.Win32.Conficker [Ikarus]
Scan Infected computers
To detect it from network we use mikrotik tools ‘torch’ and pointing it to port 445 :
Source address of infected computer easily found using torch.
Using FreeBSD I use ipaudit from ports :
# ipaudit -S -p445 -e vge2
vge2 is lancard name of gigabit ethernet
result this report :
172.88.2.91 204.9.117.33 6 2472 445 0 124 0 2 000c421a264a 001bfc184f7c 172.88.2.91 204.82.181.68 6 2520 445 0 62 0 1 000c421a264a 001bfc184f7c 172.88.2.91 205.114.221.5 6 2404 445 0 124 0 2 000c421a264a 001bfc184f7c 172.88.2.91 209.12.61.105 6 2470 445 0 124 0 2 000c421a264a 001bfc184f7c 172.88.2.91 209.104.160.79 6 2445 445 0 124 0 2 000c421a264a 001bfc184f7c 172.88.2.91 211.99.189.88 6 2473 445 0 62 0 1 000c421a264a 001bfc184f7c 172.88.2.91 212.28.165.110 6 2523 445 0 62 0 1 000c421a264a 001bfc184f7c 172.88.2.91 215.33.181.61 6 2495 445 0 62 0 1 000c421a264a 001bfc184f7c 172.88.2.91 217.106.15.31 6 2498 445 0 62 0 1 000c421a264a 001bfc184f7c 172.88.2.91 221.93.208.46 6 2501 445 0 62 0 1 000c421a264a 001bfc184f7c 172.88.2.91 222.117.21.115 6 2444 445 0 124 0 2 000c421a264a 001bfc184f7c 172.88.2.113 211.24.71.27 6 2783 445 0 124 0 2 000c421a264a 0019215ed9f0 172.88.2.113 211.87.202.27 6 2652 445 0 62 0 1 000c421a264a 0019215ed9f0 172.88.2.113 211.114.103.46 6 2787 445 0 124 0 2 000c421a264a 0019215ed9f0 172.88.2.113 213.45.200.31 6 2728 445 0 62 0 1 000c421a264a 0019215ed9f0 172.88.2.113 213.73.144.24 6 2813 445 0 124 0 2 000c421a264a 0019215ed9f0 172.88.2.113 215.105.97.61 6 2915 445 0 62 0 1 000c421a264a 0019215ed9f0 172.88.2.113 217.77.57.113 6 2777 445 0 124 0 2 000c421a264a 0019215ed9f0 172.88.2.113 217.81.23.90 6 2906 445 0 62 0 1 000c421a264a 0019215ed9f0 172.88.2.113 219.95.185.28 6 2695 445 0 62 0 1 000c421a264a 0019215ed9f0 172.88.2.122 172.88.3.255 17 137 137 0 184 0 2 ffffffffffff 001921572a28 172.88.2.123 172.111.44.96 6 4749 445 0 62 0 1 000c421a264a 001921e03ba9
What to do next?
1. Disinfect infected computer
Using kidokiller utility from kaspersky, download from here.
Run it to find and cure it.
Prevent next attack
Minimum patch needed to install in our Win XP computer :
How do we know if that patch already installed?
Click Start -> Setting -> Control Panel -> Add or Remove Programs
Make sure to thick on ‘Show updates’
Example of installed patch :
Is that enough?
I don’t know, I just add other security patch installed :
WindowsXP-KB938464-v2-x86-ENU.exe WindowsXP-KB941569-x86-ENU.EXE WindowsXP-KB946648-x86-ENU.exe WindowsXP-KB950762-x86-ENU.exe WindowsXP-KB950974-x86-ENU.exe WindowsXP-KB951066-x86-ENU.exe WindowsXP-KB951376-v2-x86-ENU.exe WindowsXP-KB951698-x86-ENU.exe WindowsXP-KB951748-x86-ENU.exe WindowsXP-KB952954-x86-ENU.exe WindowsXP-KB953155-x86-ENU.exe WindowsXP-KB954459-x86-ENU.exe WindowsXP-KB954600-x86-ENU.exe WindowsXP-KB955069-x86-ENU.exe WindowsXP-KB956802-x86-ENU.exe WindowsXP-KB956803-x86-ENU.exe WindowsXP-KB956841-x86-ENU.exe WindowsXP-KB957097-x86-ENU.exe WindowsXP-KB958644-x86-ENU.exe WindowsXP-KB958687-x86-ENU.exe WindowsXP-KB960225-x86-ENU.exe WindowsXP-KB967715-x86-ENU.exe
Plus make sure to update to latest definition virus for my anti virus software.
It work well 🙂