January 2009 - Posts

Using Logparser + Eventcomb to find malware
During the course of these Conficker / Downadup issues we typically see cases that started because accounts are getting locked out.  I pause briefly here to point out that account lockouts are the work of the devil and are a sorry excuse for most Read More...
Posted 28 January 09 05:04 by kfalde | 0 Comments   
Filed under
How-to: Removal of Conficker in your FCS environment
Another Conficker post :) however this one is aimed at our FCS customers. It semi-applies to other customers however other AV vendors operated differently with regards to updates etc so this won’t necessarily be applicable to all. So today is Patch Tuesday Read More...
Posted 13 January 09 01:46 by kfalde | 2 Comments   
More on File Shares and Autorun.inf with regards to malware
So in my last post I mentioned the fact that Conficker/Downad whatever can also have a component that will spread through file shares that allow everyone to write at the root level of the file share. So a typical autorun.inf looks something like this.. Read More...
Posted 12 January 09 11:32 by kfalde | 0 Comments   
Malware Win32/Conficker.B W32.Downadup.B
So for the past 2 weeks now we are absolutely getting hammered with calls in CSS Security here at MS with organizations contracting this piece of malware. You can find write-ups from various AV companies at the following URL’s http://www.ca.com/us/securityadvisor/virusinfo/virus.aspx?id=76852 Read More...
Posted 08 January 09 12:37 by kfalde | 16 Comments   
Filed under

Search

This Blog

Syndication

Page view tracker