ASProx botnet dials into Conficker domains The zombie network created by the Conficker worm is yet to go "live", but it's displaying curious behaviour that yields potential clues to its origins and purpose. Variants of the Conficker (Downadup) worm spread by exploiting a vulnerability in the Microsoft Windows server service patched by Redmond in October. It spreads …
"Nazario cautions that using either the figure of unique IPs seen in any one day or the self reporting value generated by the worm itself to tag infected hosts is necessarily reliable."
Try this, it's still clumsy but actually has a meaning:
"Nazario cautions that neither the number of unique IPs seen in any one day nor the number of self reporting values generated by the worm itself (to tag infected hosts) is necessarily an accurate count of infected machines.
The only problem is that the average person who's got Conficker, knows it and wants to do something about is only told by the forums that he must patch and take anti-virals at full strength.
Nobody tells him that he could install Ubuntu, which is easy, slim, blindingly fast and free, with free software and can't get infected.
Whenever I raise this matter Windows enthusiastasmisrepresent what Linux has achieved, even to the point of downright lying and Linux geeks seem to say, Oh, I'm not interested in helping people play with my toy however good it is.
So Ubuntu fails to star. Please come to the aid of the party.
I am accused of being a Scienetologist. I am simply a decent agnostic liberal humanist, who thinks the old good thing about Scientology is the Wheatstone Bridge.
Charles Norrie
I've seen the first edition of Fowler's Modern English Usage as downloads, and I think he died long enough ago for it to be out of copyright. It's idiosyncratic and antique, but some of you guys really need to read it.
The second edition, amended by Sir Ernest Gower, is also good. Don't even think about buying the current third edition.
Accused of being a scientologist? You can't even SPELL scientologist.
I've got Ubuntu. There it sits, in my second fastest computer, currently not powered up because there are so many programs I frequently need that it will not run. Maybe the rise of the netbooks will work a change on that situation, someday. I would welcome this, but it isn't here yet.
Like many computer users, I don't have a dog in the Microsoft/Linux fight. For the moment, Windows (XP) does the job and Linux flavours don't, that's all. The difference is between having a tool that works but sometimes breaks and having one that doesn't break but doesn't work either.
My third fastest computer would probably be the fastest, but it has Vista installed. I don't use that much either, but it will run a bunch of games that Ubuntu cannot, and display them on my 50 inch plasma TV, so it gets fired up from time to time.
"Some of the anticipated Conficker domains have started to appear on the ASProx botnet over the past week or so."
Actually, for more than 2 weeks. A log with IP changes for all the domains that were anticipated for the 17-31 period shows that the first day some of those domains were pointed to a botnet host was january 20th.
[2009-01-20 12:29:32] The address fmhxqutvccr.org ( ERROR ) was changed to:
24.72.163.104 = h104.163.72.24.cable.srlk.cablerocket.net
24.99.237.81 = c-24-99-237-81.hsd1.ga.comcast.net
24.107.209.119 = 24-107-209-119.dhcp.stls.mo.charter.com
24.165.123.218 = cpe-24-165-123-218.cinci.res.rr.com
24.170.188.201 = user-0calf69.cable.mindspring.com
65.102.56.213 =
67.141.209.213 = h213.209.141.67.dynamic.ip.windstream.net
67.241.202.212 = cpe-67-241-202-212.maine.res.rr.com
68.112.80.134 = 68-112-80-134.dhcp.k717.oh.charter.com
69.66.237.74 = smnr-03-1354.dsl.iowatelecom.net
70.154.82.100 = adsl-070-154-082-100.sip.flo.bellsouth.net
70.244.82.33 = ppp-70-244-82-33.dsl.rcsntx.swbell.net
70.254.126.181 = adsl-70-254-126-181.dsl.hrlntx.swbell.net
76.120.154.98 = c-76-120-154-98.hsd1.pa.comcast.net
98.209.156.151 = c-98-209-156-151.hsd1.mi.comcast.net
The full log is available here: http://nemesis.te-home.net/News/IP_Changes_For_Downadup_Domain_List.html
"The only problem is that the average person who's got Conficker, knows it and wants to do something about is only told by the forums that he must patch and take anti-virals at full strength.
Nobody tells him that he could install Ubuntu, which is easy, slim, blindingly fast and free, with free software and can't get infected."
Eh?? What geekworld do you live in?!
Yes, of course, the "average" person who only knows how to use their computer in terms of the right things to click on to do the tasks they need to, will be capable of downloading a Linux installation, burning the iso, and then running through an install. Then setting up their broadband again (with no help from the ISP!), reinstalling all their data (they did of course back all that up first didn't they?!), and then learning how to convert any files that now won't open because they haven't got a Linux version of whatever they used to use.
And then they find their printer/digital camera/phone sync software doesn't work either.
I'm not debating the relative merits of Windows vs. Linux, but your pie-in-the-sky suggestion is so ignorant of the "average" user it's just laughable!
Dude - haven't you forgotten the huge company & corporation networks that are soley windows platforms? Some of the main figures of infected machines come from boxes that are on business networks
I dunno about you but as an IT consultant I sure as hell ain't gonna be leading the project to convert the entire company to a new platform - including re-writing all internal applications, testing them, retraining ALL staff..etc..
I'm a linux fan, i've used it for over a decade - but mate - get real.
Big mahoosive get real in response to everything you've said.
You can be Paris' new best friend in her special lalaland house.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
