{"id":1658,"date":"2009-04-06T08:15:24","date_gmt":"2009-04-06T08:15:24","guid":{"rendered":"https:\/\/www.darknet.org.uk\/?p=1658"},"modified":"2015-09-09T19:38:08","modified_gmt":"2015-09-09T11:38:08","slug":"how-to-scan-for-conficker-worm","status":"publish","type":"post","link":"https:\/\/www.darknet.org.uk\/2009\/04\/how-to-scan-for-conficker-worm\/","title":{"rendered":"How to Scan for Conficker Worm"},"content":{"rendered":"<p>A bit of an update to the conficker worm that is supposedly scheduled for new updates and instructions today wednesday 1st. April 2009 and that nobody except for the bad guys knows what those instructions would be.  Fyodor has rolled out a new nmap beta release to the nmap scripting engine that enables it to check if a particular machine is possibly infected by the conficker worm.<\/p>\n<blockquote><p>\nThanks to excellent research by Tillmann Werner and Felix Leder of <a href=\"http:\/\/www.honeynet.org\/\">The Honeynet Project<\/a> and implementation work by Ron Bowes, David Fifield, Brandon Enright, and Fyodor, we&#8217;ve rolled out a new Nmap release which can remotely scan for and detect infected machines. Nmap 4.85BETA5 is now available from the <a href=\"http:\/\/nmap.org\/download.html\">download<\/a> page, including official binaries for Windows and Mac OS X. To scan for Conficker, use a command such as:\n<\/p><\/blockquote>\n<pre>nmap -PN -T4 -p139,445 -n -v --script=smb-check-vulns --script-args safe=1 IP<\/pre>\n<script async src=\"https:\/\/pagead2.googlesyndication.com\/pagead\/js\/adsbygoogle.js?client=ca-pub-3033787195489589\"\r\n     crossorigin=\"anonymous\"><\/script>\r\n<!-- Darknet Responsive Post Ad Links [previously link ad unit] -->\r\n<ins class=\"adsbygoogle\"\r\n     style=\"display:block\"\r\n     data-ad-client=\"ca-pub-3033787195489589\"\r\n     data-ad-slot=\"5456620019\"\r\n     data-ad-format=\"auto\"><\/ins>\r\n<script>\r\n     (adsbygoogle = window.adsbygoogle || []).push({});\r\n<\/script>\n<p>A clean machine should report at the bottom: \u201cConficker: Likely CLEAN\u201d, while likely infected machines say: \u201cConficker: Likely INFECTED\u201d.<\/p>\n<p>A useful feature to check your own network if any of your computers in the network is infected by the conficker worm. <\/p>\n<p>Tenable security have also released a new Nessus plugin #36036 <\/p>\n<blockquote><p>which performs a network based check for Windows computers infected with a variant of the Conficker virus. The scan does not need credentials, but does require ports 445 or 139 to be open between the Nessus scanner and your scanned systems. The plugin is based on research from the University of Bonn in Germany.<\/p>\n<p>Conficker exploits Windows systems vulnerable to MS08-067. Tenable has worked with many organizations to help them perform both un-credentialed network scans and credentialed patch audits with Nessus to find systems that are still vulnerable. <\/p><\/blockquote>\n<p><strong>Source:<\/strong>  <a href=\"http:\/\/www.insecure.org\">insecure.org<\/a> and <a href=\"http:\/\/blog.tenablesecurity.com\/2009\/03\/detecting-conficker-with-nessus.html\">tenablesecurity.com<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>A bit of an update to the conficker worm that is supposedly scheduled for new updates and instructions today wednesday 1st. April 2009 and that nobody except for the bad guys knows what those instructions would be. Fyodor has rolled out a new nmap beta release to the nmap scripting engine that enables it to [&hellip;]<\/p>\n","protected":false},"author":4,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_seopress_robots_primary_cat":"","_seopress_titles_title":"","_seopress_titles_desc":"","_seopress_robots_index":"","_genesis_hide_title":false,"_genesis_hide_breadcrumbs":false,"_genesis_hide_singular_image":false,"_genesis_hide_footer_widgets":false,"_genesis_custom_body_class":"","_genesis_custom_post_class":"","_genesis_layout":"","footnotes":""},"categories":[12,7],"tags":[768,3627,142,59,115,113,497],"featured_image_src":null,"featured_image_src_square":null,"author_info":{"display_name":"evilfoo","author_link":"https:\/\/www.darknet.org.uk\/author\/evilfoo\/"},"_links":{"self":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts\/1658"}],"collection":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/comments?post=1658"}],"version-history":[{"count":0,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/posts\/1658\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/media?parent=1658"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/categories?post=1658"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.darknet.org.uk\/wp-json\/wp\/v2\/tags?post=1658"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}