back to article ASProx botnet dials into Conficker domains

The zombie network created by the Conficker worm is yet to go "live", but it's displaying curious behaviour that yields potential clues to its origins and purpose. Variants of the Conficker (Downadup) worm spread by exploiting a vulnerability in the Microsoft Windows server service patched by Redmond in October. It spreads …

COMMENTS

This topic is closed for new posts.
  1. Anonymous Coward
    Anonymous Coward

    CyberSub

    "Nazario cautions that using either the figure of unique IPs seen in any one day or the self reporting value generated by the worm itself to tag infected hosts is necessarily reliable."

    Try this, it's still clumsy but actually has a meaning:

    "Nazario cautions that neither the number of unique IPs seen in any one day nor the number of self reporting values generated by the worm itself (to tag infected hosts) is necessarily an accurate count of infected machines.

  2. Jeffrey Nonken
    Unhappy

    In fact...

    ... Just adding "not" in front of "necessarily" will do the trick, though I like the first commenter's suggestion better.

  3. Eirronbc

    Utterly fascinating

    The only problem is that the average person who's got Conficker, knows it and wants to do something about is only told by the forums that he must patch and take anti-virals at full strength.

    Nobody tells him that he could install Ubuntu, which is easy, slim, blindingly fast and free, with free software and can't get infected.

    Whenever I raise this matter Windows enthusiastasmisrepresent what Linux has achieved, even to the point of downright lying and Linux geeks seem to say, Oh, I'm not interested in helping people play with my toy however good it is.

    So Ubuntu fails to star. Please come to the aid of the party.

    I am accused of being a Scienetologist. I am simply a decent agnostic liberal humanist, who thinks the old good thing about Scientology is the Wheatstone Bridge.

    Charles Norrie

  4. TeeCee Gold badge
    Unhappy

    Or this.

    "The figure of 12 million zombie clients quoted above is quite probably a load of bollocks."

    That seems clear enough.

  5. Dave Bell

    Writing

    I've seen the first edition of Fowler's Modern English Usage as downloads, and I think he died long enough ago for it to be out of copyright. It's idiosyncratic and antique, but some of you guys really need to read it.

    The second edition, amended by Sir Ernest Gower, is also good. Don't even think about buying the current third edition.

  6. Apocalypse Later
    Linux

    @Eirronbc

    Accused of being a scientologist? You can't even SPELL scientologist.

    I've got Ubuntu. There it sits, in my second fastest computer, currently not powered up because there are so many programs I frequently need that it will not run. Maybe the rise of the netbooks will work a change on that situation, someday. I would welcome this, but it isn't here yet.

    Like many computer users, I don't have a dog in the Microsoft/Linux fight. For the moment, Windows (XP) does the job and Linux flavours don't, that's all. The difference is between having a tool that works but sometimes breaks and having one that doesn't break but doesn't work either.

    My third fastest computer would probably be the fastest, but it has Vista installed. I don't use that much either, but it will run a bunch of games that Ubuntu cannot, and display them on my 50 inch plasma TV, so it gets fired up from time to time.

  7. Anonymous Coward
    Anonymous Coward

    More than a week

    "Some of the anticipated Conficker domains have started to appear on the ASProx botnet over the past week or so."

    Actually, for more than 2 weeks. A log with IP changes for all the domains that were anticipated for the 17-31 period shows that the first day some of those domains were pointed to a botnet host was january 20th.

    [2009-01-20 12:29:32] The address fmhxqutvccr.org ( ERROR ) was changed to:

    24.72.163.104 = h104.163.72.24.cable.srlk.cablerocket.net

    24.99.237.81 = c-24-99-237-81.hsd1.ga.comcast.net

    24.107.209.119 = 24-107-209-119.dhcp.stls.mo.charter.com

    24.165.123.218 = cpe-24-165-123-218.cinci.res.rr.com

    24.170.188.201 = user-0calf69.cable.mindspring.com

    65.102.56.213 =

    67.141.209.213 = h213.209.141.67.dynamic.ip.windstream.net

    67.241.202.212 = cpe-67-241-202-212.maine.res.rr.com

    68.112.80.134 = 68-112-80-134.dhcp.k717.oh.charter.com

    69.66.237.74 = smnr-03-1354.dsl.iowatelecom.net

    70.154.82.100 = adsl-070-154-082-100.sip.flo.bellsouth.net

    70.244.82.33 = ppp-70-244-82-33.dsl.rcsntx.swbell.net

    70.254.126.181 = adsl-70-254-126-181.dsl.hrlntx.swbell.net

    76.120.154.98 = c-76-120-154-98.hsd1.pa.comcast.net

    98.209.156.151 = c-98-209-156-151.hsd1.mi.comcast.net

    The full log is available here: http://nemesis.te-home.net/News/IP_Changes_For_Downadup_Domain_List.html

  8. Anonymous Coward
    Stop

    @ Eirronbc

    "The only problem is that the average person who's got Conficker, knows it and wants to do something about is only told by the forums that he must patch and take anti-virals at full strength.

    Nobody tells him that he could install Ubuntu, which is easy, slim, blindingly fast and free, with free software and can't get infected."

    Eh?? What geekworld do you live in?!

    Yes, of course, the "average" person who only knows how to use their computer in terms of the right things to click on to do the tasks they need to, will be capable of downloading a Linux installation, burning the iso, and then running through an install. Then setting up their broadband again (with no help from the ISP!), reinstalling all their data (they did of course back all that up first didn't they?!), and then learning how to convert any files that now won't open because they haven't got a Linux version of whatever they used to use.

    And then they find their printer/digital camera/phone sync software doesn't work either.

    I'm not debating the relative merits of Windows vs. Linux, but your pie-in-the-sky suggestion is so ignorant of the "average" user it's just laughable!

  9. Anonymous Coward
    Anonymous Coward

    AC,

    "And then they find their printer/digital camera/phone sync software doesn't work either."

    Why would that be? It's not like they would be migrating to Vista. The printer, digital camera, phone, iPod, etc should work just fine.

  10. g00p
    Paris Hilton

    @ eirronbc

    Dude - haven't you forgotten the huge company & corporation networks that are soley windows platforms? Some of the main figures of infected machines come from boxes that are on business networks

    I dunno about you but as an IT consultant I sure as hell ain't gonna be leading the project to convert the entire company to a new platform - including re-writing all internal applications, testing them, retraining ALL staff..etc..

    I'm a linux fan, i've used it for over a decade - but mate - get real.

    Big mahoosive get real in response to everything you've said.

    You can be Paris' new best friend in her special lalaland house.

This topic is closed for new posts.

Other stories you might like