Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 3 replies
  • Subscribers 1 subscriber
  • Views 1138 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Tracking Conficker source down

Nevin

Hello,

Every so many days, a boatload of our PCs come up with:

Mal/Conficker.A  - C:\windows\system32\(some filename)

I've got a Windows 7 PC which is fully patched, and so I am assuming that I am not infected and that the virus/spyware alert I get is just telling me that an infected PC tried to attack me and Sophos caught it.  Am I incorrect, and I am still vulnerable to infection somehow?

Im sure we have quite a few machines here that don't even have antivirus installed and/or don't have the Microsoft KB's applied which would patch the vulnerability which allows Conficker to spread.

File and folder sharing is on, we have 1,000+ PCs on the domain.  I can't re-image all of them at once so I am hoping to just get an idea of where these unprotected machines are.  This is a school district and it's hard to keep track of laptops.

Am I right in assuming that I am not actually being infected, and if so where is the source IP address logged?  I am more familiar with McAfee's product where it was much easier for me to find this info.

Thanks!

Nevin

:21923


This thread was automatically locked due to age.
Parents
  • 0

    Make sure your systems are patched as well with the Conficker KB - http://technet.microsoft.com/en-us/security/dd452420

    Also, see if you can track the time you first start seeing Conficker and see if any machines show activity from a USB key. We had this very same issue and we managed to track it back to a USB key. We then proceeded to patch EVERY computer we had in the company whether it was connected to the network or not.

    Since doing this, we have yet to see Conficker reappear.

    Also, there are a few utilities out there that specifically search for conficker infected machines - do a Google search for conficker detection tools and run it on your network. If there are any machines that are infected it will find it.

    :21955
Reply
  • 0

    Make sure your systems are patched as well with the Conficker KB - http://technet.microsoft.com/en-us/security/dd452420

    Also, see if you can track the time you first start seeing Conficker and see if any machines show activity from a USB key. We had this very same issue and we managed to track it back to a USB key. We then proceeded to patch EVERY computer we had in the company whether it was connected to the network or not.

    Since doing this, we have yet to see Conficker reappear.

    Also, there are a few utilities out there that specifically search for conficker infected machines - do a Google search for conficker detection tools and run it on your network. If there are any machines that are infected it will find it.

    :21955
Children
No Data