Watch out for Conficker Worm

Also Known As:

TA08-297A (other),CVE-2008-4250 (other),VU827267 (other),Win32/Conficker.A (CA), Mal/Conficker-A (Sophos)
Trojan.Win32.Agent.bccs (Kaspersky),W32.Downadup.B (Symantec)

Summary

Worm:Win32/Conficker.B is a worm that infects other computers across a network by exploiting a vulnerability in the Windows Server service (SVCHOST.EXE). If the vulnerability is successfully exploited, it could allow remote code execution when file sharing is enabled. It may also spread via removable drives and weak administrator passwords. It disables several important system services and security products.
 
Microsoft strongly recommends that users apply the update referred to in Security Bulletin MS08-067 immediately.
 
Microsoft also recommends that users ensure that their network passwords are strong to prevent this worm from spreading via weak administrator passwords. More information is available here.

Symptoms

System Changes
The following system changes may indicate the presence of this malware:
  • The following services are disabled or fail to run:
  • Windows Update Service
    Background Intelligent Transfer Service
    Windows Defender
    Windows Error Reporting Services
  • Some accounts may be locked out due to the following registry modification, which may flood the network with connections:
  • HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
    "TcpNumConnections" = "0x00FFFFFE"
  • Users may not be able to connect to websites or online services that contain the following strings:
  • virus
    spyware
    malware
    rootkit
    defender
    microsoft
    symantec
    norton
    mcafee
    trendmicro
    sophos
    panda
    etrust
    networkassociates
    computerassociates
    f-secure
    kaspersky
    jotti
    f-prot
    nod32
    eset
    grisoft
    drweb
    centralcommand
    ahnlab
    esafe
    avast
    avira
    quickheal
    comodo
    clamav
    ewido
    fortinet
    gdata
    hacksoft
    hauri
    ikarus
    k7computing
    norman
    pctools
    prevx
    rising
    securecomputing
    sunbelt
    emsisoft
    arcabit
    cpsecure
    spamhaus
    castlecops
    threatexpert
    wilderssecurity
    windowsupdate

Malacañang frantic to stop Marcelino

maj-marcelinoThe public should watch out for Malacañang’s attempts to smother the expose on the involvement of justice officials in illegal drugs.

Justice Secretary Raul Gonzalez tried to do that during last Wednesday hearing at the House Committee on dangerous drugs when he attempted to turn the table on Marine Major Ferdinand Marcelino, head of the Special Enforcement Service of the Philippine Drug Enforcement Agency blaming him for not arresting on the spot the the one who offered PDEA bribe in exchange for dropping the case against Richard Brodett, Jorge Joseph, and Joseph Tecson, in their early ’20s and from well-to-do families.

It is in this context that we are wary about the statement of Defense Secretary Gilbert Teodoro to review the assignment of military personnel in civilian agencies in connection with the important role that Marcelino played in the expose of the rot in the Department of Justice.

In last Wednesday’s hearing, the congressmen allowed Gonzalez, who was one of the resource persons, to interrogate Marcelino, another resource person. That was unfair. It was a good thing Marcelino stood firm against Gonzalez’ sarcastic questioning like, “Why didn’t you handle it the way you do it in Basilan?” in his pathetic attempt to put the Marine officer on the spot and to dim the glare on his beleaguered men, Chief Prosecutor Jovencito Zuño, State Senior Prosecutor Philip Kimpo, and State Prosecutor John Resado.

Marcelino told Gonzalez,”I’m not a war freak. We all know how different the conflict in Basilan is from the case of illegal drugs.” He said the bribe offer was made through text and telephones and it was difficult to make immediate arrest considering their lack of manpower and equipment. His apology to Gonzalez underscored his humility and did not a bit diminish issue PDEA raised which is difficulty in battling illegal drugs with a corrupt justice department.

Only the timely intervention of Parañaque Rep. Roilo Golez ended Gonzalez unsuccessful attempt to harass Marcelino.

Retired Navy Commodore Rex Robles, appalled also by Gonzalez attempt to discredit Marcelino, said, “why didn’t Gonzalez instead interrogate his men”? He said Gonzalez should resign: “His talking with the Alabang boy’s lawyer (Felisberto Verano) was a unethical.”

But ethics seems to have been erased in Malacañang’s vocabulary because Gloria Arroyo continues to have full trust on him. Executive Secretary Eduardo Ermita said Wednesday that Arroyo is “concerned” about the case of the “Alabang boys” case and directed Gonzalez to finish the investigation as soon as possible.

Surely we can’t expect Gonzalez to find himself guilty. In effect, Malacañang has already cleared Gonzalez. But shouldn’t Gonzalez be held accountable for the rot that DOJ is in now? How sure are we that he is not part of it?

Ermita also has cleared his protege, Justice Undersecretary Ricardo Blancaflor who made calls to PDEA on the “Alabang Boys” case and even allowed his office to do messengerial service for Verano.

What Malacañang is working on now is a white- wash of the filthy truth that it’s impossible for an illegitimate government to institute justice. An administration borne out of crime has no moral authority to run after criminals. That is what is happening in what lawyer Frank Chavez’ called the “Department store of justice.”

“ For the right amount of money , you can shop at the DOJ for any order you want,” Chavez said.

The problem of Arroyo now is what to do with Marcelino, whose superior at the PDEA, former AFP Chief Dionisio Santiago, has allowed him to tell the truth at the House hearing. Defense Secretary Teodoro’s statement suggests that Marcelino should be returning to the military where his lips would be zipped.

Teodoro said, “By performing operations that are civilian in nature, our officers could be exposed to temptations which could also affect their career.”

Teodoro’s concern is valid but considering the gravity of anomaly that Marcelino has courageously exposed and the admirable manner that he has conducted himself, Robles said the defense secretary’s concern is “out of left field.”

Robles said the issue at hand is not a problem of military personal in civilian offices. “The issue is corruption in the justice department which a military officer has exposed.”

A Marine officer who asked not to named is disagrees with Teodoro. He said, it’s been a practice since time immemorial to assign military in a civilian position because they are perceived to be disciplined and not easily corrupted. “Temptations are everywhere,” he said.”Hindi lang sa PDEA . Kahit sa Basilan meron. It is a matter of the heart of a person that brings into play.”

Sen. Antonio Trillanes IV, who was a Philippine Navy officer and is in detention after he had exposed corruption in the military, said through his staff: “Teodoro’s statement is irrelevant to the main issues of bribery/corruption in the DOJ and the moral courage displayed by a public official in resisting and exposing attempts to bribe him and his unit. He should have just praised Maj. Marcelino.”

Another Marine officer said, “I know Marcelino. He cannot be corrupted. Lalaban ‘yan. Takot lang ma-expose ang mga gago that’s why they are ganging up on him and casting doubt on his character.”

Wait, there’s more!: Don’t have Paypal yet? What are you waiting for? Sign up now!