Protection is Here for Win32/Conficker.A and .B

Has your computer been infected recently?
Last month I wrote about the Conflicker Infection that has been the topic of many security experts.  Anyone who received an update patch from Microsoft last fall should be safe but apparently, plenty of people aren’t updating regularly.

Microsoft has recognized this infection is still around and has provided a fix along with additional information at http://www.microsoft.com/protect/computer/viruses/worms/conficker.mspx Thanks to Brett Roberts in Auckland, New Zealand for the tip.

Is it that bad?
The French publisher Libération has reported the Conficker worm disrupted computers used by the Ministry of Defense in France and grounded the Navy's Dassault Rafale aircraft.

Last Friday the City of Houston Courts System had been infected and shut itself down for the day.  While they expect the court system to be up and running on Monday, many expect to find Conficker popping up on other city systems. While I typically recommend waiting a week or so for Microsoft’s Windows Updates, this is one update too many people missed.

Additional Help
If you use OpenDNS, which I recommended last year, you’ll soon have additional protection.  Starting Monday, OpenDNS will offer a feature to help administrators detect local machines which have been infected and will block machines from phoning home their payload. This is an entirely new direction for OpenDNS but given the scope of Conficker I think they may be on the right track. If you missed my post on OpenDNS you can read more at http://billpstudios.blogspot.com/2008/03/speed-up-internet-access-with-opendns.html

Update 2/10: Reports out of Houston now indicate the city's infection was in fact W32/Virut.n a variant of the virus Virut. This is contrary to news stories still being filed. The city had been using antivirus software from McAfee which did not include a signature file for this infection. Total down time was 4 days.

PC World reports, OpenDNS has partnered with our comrades at Kaspersky to obtain updated lists of malicious IP addesses.

Update 2/12: To show how serious they think Conficker is, Microsoft has announced a $250,000 reward towards the arrest and conviction of the folks responsible for this virus.
http://www.microsoft.com/Presspass/press/2009/feb09/02-12ConfickerPR.mspx 

Update 3/26:
 Conficker Judgement Day on April 1st

 Real Conficker Danger is March 31st

 

Read More

WinPatrol Integration with Windows Explorer

I'm happy to report the release of WinPatrol 15.9. I’ve made a few improvements but also made a great bug find thanks to support and screen shots from WinPatrol friends.  Our PLUS database now exceeds over 19,000 easy to understand program descriptions that can now be accessed directly from Windows Explorer.

The following information along with a download link is available at http://www.winpatrol.com/upgrade.html.

• Explorer Integration of PLUS Info...

  
  One of the main features of WinPatrol PLUS is the ability to look up information for strange filenames. We now have over 19,000 descriptions available in a form that mere humans can understand. Our new WinPatrol now adds the ability to research programs to any executable on your system directly from Windows Explorer.
  



• Quicker Access to PLUS Info

  In previous versions of WinPatrol we shipped PLUS descriptions of some of the most popular file requests. As our database grew and things changed it became obvious that we would never be installing our entire database on local machines. Our new version removes the check for local PLUS data saving you from unnecessary access to your hard drive and speeds up access to our online database
  



• Bug Fix: Firefox 3 Cookies

  At this time WinPatrol hasn't been updated to manage cookies in Firefox 3. Cookies in Firefox 3 use a database method called SQlite which is completely different then its old plain cookies.txt file. We've removed the option if Firefox 3 or greater is detected so there is no confusion.
  



• Bug Fix: AppInit_DLL

  One non-traditional startup location frequently used by malware is a registry key AppInit_DLL found at HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows. This key is now also used by security programs as way to hide from users and malware. WinPatrol has always monitored this location successfully but recently the over use of this location helped us find a bug in the way we parsed this key. Users of Kaspersky Internet Security were the first to discover this problem because KIS 2009 actually stores four separate DLL's in this location.
  In previous versions of WinPatrol Scotty would incorrectly report filenames when there were three files or more located in this key.

Non-English version users with current language packs installed can just download our new default setup. No new text strings were added so all your text will still be localized.  New non-English setups will be available soon for new WinPatrol users.

Read More

Do All Signatures Come From Kaspersky?

You might think there exists a huge number of anti-malware programs out there. If so, you’d be right but you might be surprised to find out how many use the same anti-virus engine and signature files.

My mailbox was flooded yesterday with a number of freaked out WinPatrol users who had our software removed by Kaspersky Internet Security Suite. It seems Kaspersky was identifying WinPatrol as “pornware not-a-virus:Porn-Dialer.Win32.Agent.aw“.

I was pleased that most folks knew this must be some kind of false-positive error, but I also had my share of users in a panic blaming me for infecting their systems.

By evening, I did hear back from Kaspersky Virus Analyst, Yury Nesmachny who apologized and said,

“Sorry, it's false alarm. Its detection will be deleted in the next update. Thank you for your help.”

According to tests today with VirusTotal.com, Kaspersky has corrected this error.

I had created a standard reply for Kaspersky users but as the day continued it got worse. Apparently, a significant number of other products use signature files from Kaspersky for their products.

It wasn’t long before I received notices that Zone Alarm Security Suite was reporting WinPatrol as a porn dialer. This was followed by a couple F-Secure Internet Security users and a few who use AOL’s Active Virus Shield.

This isn’t the first time this error has occurred. Last December Panda Software tried to tell users WinPatrol was a porn dialer. Panda was pretty responsive and I appreciate the quick action from Kaspersky which hopefully, will be deployed quickly to all their partners. I’ve also been told WinPatrol isn’t alone. AdobeUpdaterInstallMgr, Quicken and many other popular applications were mis-identified.

Update: Thanks to Don Pelotas who pointed me to this list of Kaspersky partners.
http://www.kaspersky.com/oemsuccess

Read More