Conficker \con-fick-er\, Verb: To “fuck” your configuration.
Translation: The name is a German hacker pun, meaning “program that manipulates the configuration”, consisting of the abbreviation con for configuration and the nominalized form of the German verb ficken which is a very obscene German verb for sexual intercourse.
Conficker is a worm that attacks Windows Operating Systems. Some of you may have been hit with this little guy over the past few weeks and not even know it until its too late. There are a few things you can do to mitigate the problem on the home network though(For corporate networks, I hope you would have an IT staff that handles this for you and should be transparent to the end user what steps they have put in place to block this worm – In other words, you should never get infected, nor should you be able to see or know what was done to protect you, as its not your responsibility to worry about it).
For starters, patch your system. Now this works great if you were never infected and the patch is available for your system, but does nothing to help you if you get hit before the patch is released or there is no patch to begin with. Zero day flaws are a bitch to try and block when there is little to no info on what a process is doing.
In this case, its best to take another approach. Because the worm attacks certain flaws in specific windows services, its easy to disable these by default. Unless you need a service for a specific task, there is no reason for it to be running on your system! So, lets go and disable some of these right now.
From your keyboard, hold the “windows key + r” or go to start, then the run prompt. Type in services.msc. This will bring up the Windows Services Snap-in MMC. Click on the third column that says “Status” until all the started tasks are shown at the top. Now, lets go down the list of running services. Because conficker uses the “Server” service to spread itself and infect computers, we can set that to disabled. Double click the Server service. Change its startup type to disabled and if it is running, click Stop to bring down the service. Because the Server service uses a few other services to do what it needs, you can stop those as well. They are “Computer Browser”, “TCP/IP NetBIOS Helper” “Windows Firewall/Internet Connection Sharing(ICS)” and “Workstation”.
Now, if you have no other Firewall software on your pc, then you will want to at least leave the windows firewall running, but you will want to block certain ports and services under the firewall control panel(Find this in the windows control panel, icon “Windows Firewall”. The ports to block are 135-139 and 445. These are Netbios and ICS ports for windows server services, and do not need to be running unless you are sharing resources with other computers on your home network, ex: printers, folder sharing(like pictures and video, etc).
Now that these services are stopped, you will want to configure your network card. Go into the control panel and then click on “Network Connections”. Under this folder you should see something like Lan or High Speed Internet(If you are using dial up, which by then you probably won’t be networked to any other machines in your home, so you can stop right now). Find the icon for your network card, wether it be an ethernet adapter or Wifi adapter. Double click it. Click properties and bring up the General and Advanced tabs. On the General tab you will see some thing like “Client for Microsoft Networks”, “File and Printer Sharing”, etc. Uncheck “File and Printer Sharing for Microsoft Networks”. Then scroll down to “Internet Protocol(TCP/IP)” and double click it. Click the advanced button. Go to the WINS tab and check off “Disable NetBIOS over TCP/IP” and uncheck Enable LMHOSTS lookup.
(Unless you are part of a domain or active directory service and require local DNS server settings to do lan domain name lookups, you do not need this checked – This is only for local DNS, and if the worm gets in and sees these computers in the list it will know what machines to try and attack – This is only a problem if there are actually any addresses coded in the LMHOSTS file to begin with, so it really doesn’t matter if this is checked or not, but either way, you won’t need it unless you are doing your own DNS Lookups on the lan).
Last thing you can do is get the list of domains known to be hosting the worm and spreading it. This is a list compiled by the F-Secure team. Download the list here: http://f-secure.com/weblog/archives/downadup_domain_blocklist_13_16.txt
You will want to add these to your windows HOSTS file, located in c:\windows\HOSTS for windows 95,98, and Millenium, and c:\windows\system32\drivers\etc\HOSTS for XP and later. Open this file in something like notepad or word, whatever you have. You will also need to open something like excel or an OpenOffice spread sheet(OpenOffice is free!).
To manually create this HOSTS file list one line at a time in notepad would take you all day. There are over a thousand domains or so in the list, so we can use excel or OpenOffice to speed up the process. In excel, paste the list into the second column(B column) and past special so the all go down in the list into each cell one below the next. In the first column, type 127.0.0.1 and then copy and paste it down. Select all in he second column from top to the last entry in column “b” and paste special to fill in all the cells one below the next. Now save copy all the cells to the clipboard. Then paste them into the HOSTS file and save the file. If you don’t have excel or OpenOffice, then you will have to manually enter each line, starting with 127.0.0.1 and then hit tab, and then the address to block. EX:
127.0.0.1 aauhyeyu.info
If you decide to use this HOSTS list, then you will also want to turn off another service in windows to speed up your network speed. The reason we do this is because windows has a DNS service of its own that stores domain names and ip addresses in a cache, and to be sure its reading them from the HOSTS file and not from the cache, you will want to turn off this service. Don’t worry, windows will still be able to resolve domain names to ip addresses based on your ISP’s DNS servers or whatever service you are using(I prefer OpenDNS), but this helps force it to read the HOSTS file first instead of going to the cache for DNS. Some people say this slows down your Internet connection, but its only milliseconds of time it takes to read this list and doesn’t really slow down your connection enough that you will notice any difference. I have probably 5,000 or so addresses in my HOSTS file(Used mainly for blocking advertisements and malware sites) and have not seen any speed performance issues at all. In fact, in some cases, it speeds up my connection, because I block certain sites that have ads using javascript and other things to serve me scripts and images that will now never load. Greatest ad blocker is my HOSTS file.
You can now reboot to make sure these changes take place.
del.icio.us|Digg|Furl|ma.gnolia|RawSugar|reddit|Spurl|Google|StumbleUpon