Take care when Googling for Conficker info

**Glaswegian** · 04-09-2009, 01:30 PM

If you’re trawling the Web for information on disinfecting the Conficker worm, be very, very careful.

Cyber-criminals are latching onto the hype around the Windows malware threat and have started registering domain names linked to Conficker and poisoning search results to trick users into installing fake anti-virus software programs.

According to this growing list maintained by the Conficker Working Group, at least one of the domains is actively serving malware. F-Secure dug into one of the domains and found an a rogueware (fake anti-virus) campaign attempting to bilk users out of $39.95 for non-existent Conficker clean-up.

Yesterday, just hours after the release of enterprise scanning tools to help fingerprint the virulent worm, search results on Google were poisoned to serve malware for queries related to that news. In one instance, the top Google result for “nmap conficker” was serving up a redirect to a drive-by download exploit site.

http://blogs.zdnet.com/security/?p=3069

**lorjack** · 04-14-2009, 09:17 AM

Hah! Thant figures

pingu789 · 04-23-2009, 03:19 PM

Great information .I am hearing conficker info for the first time .

**vladimirb** · 04-23-2009, 03:33 PM

Yesterday I have had to deal with Conficker myself...
But Microsoft has released KBxxxxxxx to help removing Conficker...
Scanned with AVG 8.5 and removed Conficker...
Make sure you adjust account lockout policies, so Administrator can re-enable locked account because it attacks all domain user accounts and is trying to log onto system...

anudeepweb · 04-27-2009, 07:12 AM

Thank you for the great information

04-09-2009, 01:30 PM	#1 (permalink)
Glaswegian Moderator/ Rangemaster TSF Academy; Analyst, Security Team; Oor Wullie; TSF Surgeon and Resident Comic Join Date: Sep 2005 Location: Glasgow Posts: 25,408 OS: Win XP Pro SP3 / Win 7 Pro My System Blog Entries: 10	Take care when Googling for Conficker info If you’re trawling the Web for information on disinfecting the Conficker worm, be very, very careful. Cyber-criminals are latching onto the hype around the Windows malware threat and have started registering domain names linked to Conficker and poisoning search results to trick users into installing fake anti-virus software programs. According to this growing list maintained by the Conficker Working Group, at least one of the domains is actively serving malware. F-Secure dug into one of the domains and found an a rogueware (fake anti-virus) campaign attempting to bilk users out of $39.95 for non-existent Conficker clean-up. Yesterday, just hours after the release of enterprise scanning tools to help fingerprint the virulent worm, search results on Google were poisoned to serve malware for queries related to that news. In one instance, the top Google result for “nmap conficker” was serving up a redirect to a drive-by download exploit site. http://blogs.zdnet.com/security/?p=3069 __________________ Iain - Defender of the Haggis and all things Scottish. I don't help by PM - post in the Forums. PC Safety & Security::PC running a bit slow?::Donate::Photographers Corner

04-14-2009, 09:17 AM	#2 (permalink)
lorjack TSF Enthusiast Join Date: Nov 2007 Location: Planet Earth Posts: 2,205 OS: Windows 2K, XP Pro sp3, Windows Vista, Windows 7, Ubuntu	Re: Take care when Googling for Conficker info Hah! Thant figures

04-23-2009, 03:19 PM	#3 (permalink)
pingu789 Registered User Join Date: Apr 2009 Posts: 2 OS: xp	Re: Take care when Googling for Conficker info Great information .I am hearing conficker info for the first time . __________________ I love google

04-23-2009, 03:33 PM	#4 (permalink)
vladimirb Mentor Hardware Team Join Date: Mar 2008 Location: Banja Luka, Serb Republic Posts: 3,664 OS: xp pro sp3, Server 2003, Windows 7 Professional x64bit My System	Re: Take care when Googling for Conficker info Yesterday I have had to deal with Conficker myself... But Microsoft has released KBxxxxxxx to help removing Conficker... Scanned with AVG 8.5 and removed Conficker... Make sure you adjust account lockout policies, so Administrator can re-enable locked account because it attacks all domain user accounts and is trying to log onto system... __________________ MCP - MCSA Cisco SMB Account Manager

04-27-2009, 07:12 AM	#5 (permalink)
anudeepweb Registered User Join Date: Apr 2009 Posts: 5 OS: Ubuntu	Re: Take care when Googling for Conficker info Thank you for the great information