Return Styles: Pseud0ch, Terminal, Valhalla, NES, Geocities, Blue Moon.

Pages: 1-

conficker / downadup

Name: Anonymous 2009-01-20 4:25

Okay /prog/, what do you know about it?

Name: Anonymous 2009-01-20 4:26

Absolutely nothing.

Name: Anonymous 2009-01-20 4:27

Sounds like confucker to me.

Name: =+=*=F=R=O=Z=E=N==V=O=I=D=*=+= !FrOzEn2BUo 2009-01-20 4:29

I don't use buggy MS services.
 I disabled them long ago.

_________________________
orbis terrarum delenda est

Name: Anonymous 2009-01-20 5:23

what are they?

Name: =+=*=F=R=O=Z=E=N==V=O=I=D=*=+= !FrOzEn2BUo 2009-01-20 5:26

>>5
see http://en.wikipedia.org/wiki/Conficker

_________________________
orbis terrarum delenda est

Name: Anonymous 2009-01-20 6:52

haha fucker

Name: Anonymous 2009-01-20 6:55

Hey, send me a rapidshare.

Name: Anonymous 2009-01-20 6:59

Conficker is mostly found on Windows XP machines.
looks like microsoft really wants people to upgrade to vista.

Name: Anonymous 2009-01-20 8:59

>>1
What do you want to know about it?

Seeing your post I downloaded a sample of this worm, and took a 5 minute look at it, first glance shows that it's made of 2 layers, the first layer does the decryption of an UPX packed executable which has its header erased to confuse novice reverse engineers, the loader layer is obfuscated by splitting the code into chunks and shuffling them at random then interconnecting by jumps. It contains anti-debugging code and other useless crap. The real worm code which is located after the decryption(loader)/decompression(upx) seems to contain a driver which does something to tcpip.sys in the memory, probably used to circumvent tools like netstat and other firewalls. The code of the main worm seems to have options for upnp discovery and some code for installing itself as a service. There's also a list of badwords containing online antivirus/security sites, probably used to block them. Another list contains mysqpace/msn/ebay/cnn/aol and 23.org/ask.com/yahoo.com/google.com/baidu.com and others. There is also a list of commong used passwords. There is also code which seems to be used to disable security center and other services. This is all I can tell you from a 5 minute glance, for more information, I would have to spend some 20 minutes rebuilding the original executable that contained the worm before it was "prepared for distribution".

Name: =+=*=F=R=O=Z=E=N==V=O=I=D=*=+= !FrOzEn2BUo 2009-01-20 11:47

>>10
This is already reverse engineered:
 http://www.f-secure.com/v-descs/worm_w32_downadup_al.shtml

_________________________
orbis terrarum delenda est

Name: Anonymous 2009-01-20 12:52

>>10
wat

Name: Anonymous 2010-12-17 1:38

This post brought to you by the Gay Nigger Association of America

Don't change these.
Name: Email:
Entire Thread Thread List