From Microsoft: Conficker infects other computers across a network by exploiting a vulnerability in the Windows Server service (SVCHOST.EXE). If the vulnerability is successfully exploited, it could allow remote code execution when file sharing is enabled. It may also spread via removable drives and weak administrator passwords. It disables several important system services and security products.

Once your computer is infected, it is now “owned” by the Conficker worm and its creators. It becomes one of millions of infected PC’s making up a massive “army” of infected machines that could possibly be used to implement the author’s bidding at any time.  Here’s the scary part- all these infected machines ( or “bots”) are currently programmed to “check in” with their master on April 1st to get new instructions. No one knows exactly what will happen on that day.

Pundits have speculated a variety of different malicious deeds this massive bot army could undertake on 4/1. One possibility is that the author’s will grab sensitive personal data off all these machines. Another thought is that they will launch massive denial of service attacks on major websites.  Still others believe that this bot army will be sold off for the purposes of sending out Spam worldwide.  No one, except the authors knows for sure.

Regardless, make sure your machines have AntiVirus software, and that its up-to-date. If you’ve just recently installed AntiVirus, make sure you do a full system scan. Make sure Automatic Updates are turned on.

The Honeynet project just released a new python script you can run to scan your network for infected machines. Here’s a link to it:

http://honeynet.org/node/388

For more info about this worm you can check out any of the following links:

http://en.wikipedia.org/wiki/Conficker

http://vil.nai.com/vil/content/v_153464.htm

This one’s REAL technical but a great read if you have the time:

http://mtc.sri.com/Conficker/addendumC/

Let’s be careful out there….

In theory, you should be able to simply set up Internet Sharing on your Windows Mobile device with Bluetooth PAN. Then on your Mac, simply create a BlueTooth PAN connection. The problem with this is that you run the risk of eating up your mobile device’s battery much quicker as its using its 3G connection and its bluetooth connection simultaneouslly. Even though it should work, I never could get it going, anyways. Ideally, we want to plug the phone in via USB, so that it is charging while sharing its connection. OSX won’t support the standard ActiveSync USB Internet Sharing method, so you’ll need to do a little work to get it going.

First download these files

Unzip and Copy all three files to /Library/Modem Scripts

Back on your Windows Mobile device, in the USB connection settings, change USB to mode to MODEM instead of ActiveSync. You may get a warning here that ActiveSync won’t work when Modem is selected.  Remember to change it back later when you are ready to sync up again with a Windows computer. Once you’ve selected modem, plug your device into your Mac via USB.

Now, go to your Network Preferences menu.

On the left side, you should see your list of Network Interfaces.  Click the little “+” sign to add an interface. Click Interface drop down menu, and you should see a choice for “Samsung CDMA Technologies”. Go ahead and choose it, and click CREATE. it should populate itself on the left-hand pane now.

Highlight the new Samsung Entry, and on the right side make the following entries:

Configuration: Default

Telephone Number: wap.cingular

Account Name: WAP@CINGULARGPRS.COM

Password: CINGULAR1

Now click Advanced…

On the Modem Tab, make sure Vendor is Samsung and Model is GPRS (GSM/3G)

On the PPP tab:

For Session, Uncheck “Redial if Busy”

Next to Settings, choose CONFIGURATION and select “Send PPP echo packets” and uncheck: Use TCP header compression.

Apply all these changes and lock the Network Preferences, and you’re ready to test.

Its a good idea when testing to disable your Wi-Fi so you can be sure you’re genuinely using your mobile devices WAN.

Now, highlight the Samsung modem, and on the right side, click CONNECT. If all goes correct, you should see a little meter with your connection strength, and you should now be able to surf the web. Go for it!

To use the script below, first determine how many days/months you want to use as your cutoff and enter it in the script in this snippet:

strPruneDate = DateAdd(“d”, -3, Date)

For the above example, I’m looking for files older than 3 days. You could change “d” to “m” and look for months if you like.

Next, you need to specify which directory you want, and enter the drive and path in the two strings below:

strDrive = “c:”
strPath = “temp”

In the above example, I’m using C:\Temp.

Save the text with .VBS extension, and double click it to run. Alternately, you could stick it in a batch file with commands like this and then use Windows Scheduler to run this every so often:

wscript prunefiles.vbs

Here’s the vbscript code:

Option Explicit

Dim strPruneDate, strDay, strMonth, strYear, strTargetDate, strDate
Dim strComputer, strDrive, strPath, strPathAlt, strName
Dim objWMIService
Dim colFiles, objFile
Dim colFolders, objFolder
Dim strFolderPath, strFilePath
Dim colSubFolders, objSubFolder
Dim strSubFolderPath, strSubFilePath
Dim colSubFiles, objSubFile

strPruneDate = DateAdd(“d”, -3, Date)

strDrive = “c:”
strPath = “temp”

strPathAlt = Replace(strPath, “\\”, “\”)
strName = strDrive & “\” & strPathAlt

strDay = Day(strPruneDate)
If Len(strDay) < 2 Then
strDay = “0″ & strDay
End If
strMonth = Month(strPruneDate)
If Len(strMonth) < 2 Then
strMonth = “0″ & strMonth
End If
strYear = Year(strPruneDate)
strTargetDate = strYear & strMonth & strDay

strComputer = “.”

Set objWMIService = GetObject(“winmgmts:\\” & strComputer)
Set colFiles = objWMIService.ExecQuery _
(“SELECT * FROM CIM_DataFile WHERE Drive = ‘” & strDrive & _
“‘ AND Path = ‘\\” & strPath & “\\’”)
Set colFolders = objWMIService.ExecQuery _
(“ASSOCIATORS OF {Win32_Directory.Name=’” & strName & “‘} ” _
& “WHERE AssocClass = Win32_Subdirectory ” _
& “ResultRole = PartComponent”)

For Each objFile in colFiles
FilecreationdateCheck
Next

Sub FilecreationdateCheck
strDate = Left(objFile.creationdate, 30)
If strDate < strTargetDate Then
objfile.delete objFile.Name
‘ Replace w/ wscript.echo after testing
End If
End Sub