DownAdUp - Conficker Detection Software

Message boards : Number crunching : DownAdUp - Conficker Detection Software
Message board moderation

To post messages, you must log in.

Previous · 1 · 2 · 3 · Next

AuthorMessage
Profile Dirk Sadowski
Volunteer tester

Send message
Joined: 6 Apr 07
Posts: 7105
Credit: 147,663,825
RAC: 5
Germany
Message 881317 - Posted: 1 Apr 2009, 16:36:44 UTC
Last modified: 1 Apr 2009, 16:38:56 UTC


@ SuperJoker

Is this name well for english forums?
In Germany 'fi**er' mean something different! ;-D


@ -=SuperG=-

AFAIK, they didn't said at which time he will be active.

ID: 881317 · Report as offensive
Profile jason_gee
Volunteer developer
Volunteer tester
Avatar

Send message
Joined: 24 Nov 06
Posts: 7489
Credit: 91,093,184
RAC: 0
Australia
Message 881321 - Posted: 1 Apr 2009, 16:48:58 UTC
Last modified: 1 Apr 2009, 17:11:15 UTC

Hi Sutaru,
In English this is fine, but I do feel as an international forum that the name should be obfuscated as required by the forum rules, out of respect for our German friends (especially youngsters).

@Everyone, I doubt this is an April fools day hoax, from evidence I have seen, but I sincerely suggest if this proves to be as such, that you send an invoice to Symantec and other sources for your precious time invested in dealing with the warning emails and scanning time. We should expect security professionals to be just that.

[Edit: To explain/clarify, the general recent rise in false detections is indicative of heuristics abuse for benchmark purposes, and has me changing two schools' AV vendor licences at great expense. They will never get our business again. Expect nothing but professionalism from those that protect your data.]
"Living by the wisdom of computer science doesn't sound so bad after all. And unlike most advice, it's backed up by proofs." -- Algorithms to live by: The computer science of human decisions.
ID: 881321 · Report as offensive
Profile Dirk Sadowski
Volunteer tester

Send message
Joined: 6 Apr 07
Posts: 7105
Credit: 147,663,825
RAC: 5
Germany
Message 881335 - Posted: 1 Apr 2009, 17:10:31 UTC
Last modified: 1 Apr 2009, 17:11:56 UTC


@ jason_gee

Uhh.. I think not possible..

Somebody changed now the title of this thread to 'confi**er'..


BTW.
I'm not a young boy.. ;-D
Sadly.. I would like to be much younger..
..if I could have one wish.. *dreaming* :-D

ID: 881335 · Report as offensive
Cosmic_Ocean
Avatar

Send message
Joined: 23 Dec 00
Posts: 3027
Credit: 13,516,867
RAC: 13
United States
Message 881337 - Posted: 1 Apr 2009, 17:13:23 UTC

Yeah, nobody ever specifically mentioned "midnight", which is also another conundrum because going by UTC, there's only one midnight, but going with local timezones, there are... a lot more. All that I saw in all the research is that it would "activate on April 1". So the day is not done, there's still time! :D
Linux laptop:
record uptime: 1511d 20h 19m (ended due to the power brick giving-up)
ID: 881337 · Report as offensive
Profile jason_gee
Volunteer developer
Volunteer tester
Avatar

Send message
Joined: 24 Nov 06
Posts: 7489
Credit: 91,093,184
RAC: 0
Australia
Message 881339 - Posted: 1 Apr 2009, 17:14:46 UTC - in response to Message 881335.  

Not just yourself Sutaru ;) And I hope not a hoax, because that would make some people lose their jobs.

Don't mess with the data !
"Living by the wisdom of computer science doesn't sound so bad after all. And unlike most advice, it's backed up by proofs." -- Algorithms to live by: The computer science of human decisions.
ID: 881339 · Report as offensive
Profile ccappel
Avatar

Send message
Joined: 27 Jan 00
Posts: 362
Credit: 1,516,412
RAC: 0
United States
Message 881348 - Posted: 1 Apr 2009, 17:42:57 UTC - in response to Message 881307.  
Last modified: 1 Apr 2009, 17:43:33 UTC

and apparently the Virus was a dud.

April Fools!

In no way was I implying that an April Fools joke was being perpetrated by the security professionals themselves, but by the virus writer...put in enough code to imply an activation of April 1 and enough confusing code to obfuscate the virus' intended actions.

Or maybe the security professionals (and enough of us users) did their job and made this a non-event.

However, I do agree with the sentiment that the day is not over yet.
"Life is a tragedy for those who feel, and a comedy for those who think."

"I never get into an argument that I cannot win."
ID: 881348 · Report as offensive
Josef W. Segur
Volunteer developer
Volunteer tester

Send message
Joined: 30 Oct 99
Posts: 4504
Credit: 1,414,761
RAC: 0
United States
Message 881363 - Posted: 1 Apr 2009, 18:47:31 UTC - in response to Message 881348.  

and apparently the Virus was a dud.

April Fools!

In no way was I implying that an April Fools joke was being perpetrated by the security professionals themselves, but by the virus writer...put in enough code to imply an activation of April 1 and enough confusing code to obfuscate the virus' intended actions.

Or maybe the security professionals (and enough of us users) did their job and made this a non-event.

However, I do agree with the sentiment that the day is not over yet.

The payload of the virus is strongly encrypted, making disassembly impossible; that's why there is uncertainty about the extent of its effects.

I presume the researchers have set an infected computer's clock ahead to get some idea of what happens. It's curious that there isn't a more definite statement than "April 1".
                                                               Joe
ID: 881363 · Report as offensive
Profile -=SuperG=-
Avatar

Send message
Joined: 3 Apr 99
Posts: 63
Credit: 89,161,651
RAC: 23
Canada
Message 881370 - Posted: 1 Apr 2009, 19:04:19 UTC

@Jason_gee

Sorry you are having trouble with Symantec.

I personally use their products loyally and have had little or no issues with the 6 schools and dozen or so companies we have it deployed at. I would appreciate it if you would stop bashing by name and perhaps step back and look at the whole picture.

This is not a product bashing thread. I don't care what your experiences are with it.
Boinc Wiki




"Great spirits have always encountered violent opposition from mediocre minds." -Albert Einstein
ID: 881370 · Report as offensive
Profile ML1
Volunteer moderator
Volunteer tester

Send message
Joined: 25 Nov 01
Posts: 21669
Credit: 7,508,002
RAC: 20
United Kingdom
Message 881380 - Posted: 1 Apr 2009, 19:26:24 UTC
Last modified: 1 Apr 2009, 19:28:01 UTC

This Confickering fiasco should at least cause "pause for thought"...

So who has gained the greatest free publicity (and profits) from all of this I wonder?

Meanwhile, I wonder what the Marketing spin is from Microsoft for all the fun and fear surrounding their products.

Also note that Microsoft also sell anti-virus solutions for their very own products...


And meanwhile a how-many-millions strong Microsoft OS Botnet slumbers...


For myself, I'm just horrified by all the wasted time, effort and miles of media coverage over something that should not be a problem in the first place!

What a waste!!

Keep searchin',
Martin
See new freedom: Mageia Linux
Take a look for yourself: Linux Format
The Future is what We all make IT (GPLv3)
ID: 881380 · Report as offensive
Profile Misfit
Volunteer tester
Avatar

Send message
Joined: 21 Jun 01
Posts: 21804
Credit: 2,815,091
RAC: 0
United States
Message 881381 - Posted: 1 Apr 2009, 19:28:22 UTC - in response to Message 881370.  

I don't care what your experiences are with it.

Now there's a statement of intolerance. You want your pro-Symantec view to be heard but IYO Jason's anti-Symantec view should be suppressed. Jason backed up his comment with his experience of the product, as did you.

As for my experience... I stopped using it years ago because of all the false positives and what I viewed as bloatware. Even after uninstalling it was still all over my registry.
me@rescam.org
ID: 881381 · Report as offensive
Profile Paul D Harris
Volunteer tester

Send message
Joined: 1 Dec 99
Posts: 1122
Credit: 33,600,005
RAC: 0
United States
Message 881384 - Posted: 1 Apr 2009, 19:33:13 UTC
Last modified: 1 Apr 2009, 19:34:58 UTC

Keep using NORTON and you will be infected due to all the false positives I hear 2009 is better but I still don't use it and it is free from my ISP.
ID: 881384 · Report as offensive
Profile -=SuperG=-
Avatar

Send message
Joined: 3 Apr 99
Posts: 63
Credit: 89,161,651
RAC: 23
Canada
Message 881389 - Posted: 1 Apr 2009, 19:48:17 UTC - in response to Message 881381.  

I don't care what your experiences are with it.

Now there's a statement of intolerance. You want your pro-Symantec view to be heard but IYO Jason's anti-Symantec view should be suppressed. Jason backed up his comment with his experience of the product, as did you.

As for my experience... I stopped using it years ago because of all the false positives and what I viewed as bloatware. Even after uninstalling it was still all over my registry.


Your right, that was very intolerant. I just don't understand why people feel they need to bash a product when all that product is doing is trying to help. As far as Pro-Symantec - I was simply defending the software...

It's just our opinion anyways, I just don't think it needs to be done here.
Boinc Wiki




"Great spirits have always encountered violent opposition from mediocre minds." -Albert Einstein
ID: 881389 · Report as offensive
Cosmic_Ocean
Avatar

Send message
Joined: 23 Dec 00
Posts: 3027
Credit: 13,516,867
RAC: 13
United States
Message 881394 - Posted: 1 Apr 2009, 20:17:01 UTC

Every major AV solution has its "hay-day" where it is in the spotlight and does a really good job at doing what it was intended for. Over the past few years I have seen several cycles from several very good pieces of software.

Norton was the best a few years ago, and then McAfee has its chance to rise and did a great job, then there was a time where I didn't keep up for a while, then it was all about Nod32, then AVG was on top, and now my preference is Avira. My choice to move to Avira is that colleague of mine uses it at work and recommends it to clients, so I gave it a try and it found 14 things that were legitimately bad that AVG completely ignored/missed.

Regarding Symantec/Norton and their reliability.. My father's company laptop has Symantec Enterprise on it, and it was able to find three trojans, but could not do anything about them. AVG found 11 trojans and wiped them all out.

So I think what I'm saying is that everyone has a preference, but the bottom line is that no one company has the best product. For the best result (being infection-free), the use of multiple solutions simultaneously is the way to go. Only caveat with that is that a lot of times they don't play nicely with each other, but from what I have seen, it is mostly a conflict regarding the resident shield (as AVG calls it), or in general terms, real-time monitoring. If you disable all (or all but one) of the real-time monitoring, they will play nicely together just fine. You can scan whole disks or just certain files with any of the apps at any time.

[/rant]
Linux laptop:
record uptime: 1511d 20h 19m (ended due to the power brick giving-up)
ID: 881394 · Report as offensive
Profile -=SuperG=-
Avatar

Send message
Joined: 3 Apr 99
Posts: 63
Credit: 89,161,651
RAC: 23
Canada
Message 881471 - Posted: 2 Apr 2009, 0:04:53 UTC

So... has anybody seen any outbreaks yet?
Boinc Wiki




"Great spirits have always encountered violent opposition from mediocre minds." -Albert Einstein
ID: 881471 · Report as offensive
Profile jason_gee
Volunteer developer
Volunteer tester
Avatar

Send message
Joined: 24 Nov 06
Posts: 7489
Credit: 91,093,184
RAC: 0
Australia
Message 881478 - Posted: 2 Apr 2009, 0:26:33 UTC - in response to Message 881370.  
Last modified: 2 Apr 2009, 0:56:35 UTC

@Jason_gee

Sorry you are having trouble with Symantec.

I personally use their products loyally and have had little or no issues with the 6 schools and dozen or so companies we have it deployed at. I would appreciate it if you would stop bashing by name and perhaps step back and look at the whole picture.

This is not a product bashing thread. I don't care what your experiences are with it.


That is not what I meant SuoerG, and if it came across that way I apologise. I have personally had no trouble with Symantec, but choose another vendor. Also I am sorry it was not clear that neither of the licenses dumped due to false detections at local campuses here were Symantec, but from other vendors. Heuristics & update quality were to blame at those installations, which rendered campus wide networks unusable. There is nothing wrong with expecting information and tools released to be reliable, especially when paid for, and if it proved to be fraudulent that the perpetrators are held accountable for any expense incurred (whoever they be).

False detections across most vendors are a problem from time to time, and in most cases are traceable to 'catchall' type heuristics designed on a principle of 'better to make a false detection than miss something'. In large installations that strategy often results in an expensive and unnecessary waste of time and resources, which usually has the worst impact on the very end-users the products are supposed to be protecting.

Jason
"Living by the wisdom of computer science doesn't sound so bad after all. And unlike most advice, it's backed up by proofs." -- Algorithms to live by: The computer science of human decisions.
ID: 881478 · Report as offensive
Profile -=SuperG=-
Avatar

Send message
Joined: 3 Apr 99
Posts: 63
Credit: 89,161,651
RAC: 23
Canada
Message 881507 - Posted: 2 Apr 2009, 2:31:19 UTC - in response to Message 881478.  

@Jason_gee

Sorry you are having trouble with Symantec.

I personally use their products loyally and have had little or no issues with the 6 schools and dozen or so companies we have it deployed at. I would appreciate it if you would stop bashing by name and perhaps step back and look at the whole picture.

This is not a product bashing thread. I don't care what your experiences are with it.


That is not what I meant SuoerG, and if it came across that way I apologise. I have personally had no trouble with Symantec, but choose another vendor. Also I am sorry it was not clear that neither of the licenses dumped due to false detections at local campuses here were Symantec, but from other vendors. Heuristics & update quality were to blame at those installations, which rendered campus wide networks unusable. There is nothing wrong with expecting information and tools released to be reliable, especially when paid for, and if it proved to be fraudulent that the perpetrators are held accountable for any expense incurred (whoever they be).

False detections across most vendors are a problem from time to time, and in most cases are traceable to 'catchall' type heuristics designed on a principle of 'better to make a false detection than miss something'. In large installations that strategy often results in an expensive and unnecessary waste of time and resources, which usually has the worst impact on the very end-users the products are supposed to be protecting.

Jason


No need to apologize, I overreacted plain and simple.

I have used Symantec software for a very long time and am simply tired of people telling me that Symantec isn't good because it slows computers down. Nothing to do with you.

IMHO Symantec slows computers down because the software is actually doing something. Most software claims to have better software but only because they base that on resources used or how long it takes to do a complete scan.

I base my experiences on Symantec Antivirus and Symantec Endpoint protection. The later is the recently released "new" version of SAV. These are corporate-centrally managed software packages for those of us who don't know. False positives and other non threatening software detection are easily remedied on a global basis using the Managers Console.

I will be the first to tell anyone that the consumer versions of Antivirus, Internet Security and AIO (Norton 360) products will slow your computer down. Using only what you need is the key to controlling how it will affect performance and/or use resources. I personally don't recommend the Internet Security or Norton 360 suites. WAY too bloated. These suites along with Panda Titanium, Mcafee Internet Security and others will bring even a new PC to its knees.The Norton Antivirus software is all I sell to my individual end user clients. And yes the 2009 version is way better than even the 2008. I also have to agree with another comment made stating that Symantec had their hay day a few years back. Everything negative seemed to follow the mass migration to Windows XP and the software activation scheme.

Once again, this is all just my experience. Everyone here uses what they think is best.

And I have ranted on way to long about this…:P

By tomorrow all will be forgotten… Hopefully including this Conficker thingy they keep calling a Worm…

Best Regards,

Howard

Boinc Wiki




"Great spirits have always encountered violent opposition from mediocre minds." -Albert Einstein
ID: 881507 · Report as offensive
Profile KW2E
Avatar

Send message
Joined: 18 May 99
Posts: 346
Credit: 104,396,190
RAC: 34
United States
Message 881550 - Posted: 2 Apr 2009, 4:23:42 UTC - in response to Message 881507.  

Altiris + SEP = What I use at work.

:)

Rob
ID: 881550 · Report as offensive
Profile Dirk Sadowski
Volunteer tester

Send message
Joined: 6 Apr 07
Posts: 7105
Credit: 147,663,825
RAC: 5
Germany
Message 881552 - Posted: 2 Apr 2009, 4:27:37 UTC
Last modified: 2 Apr 2009, 4:28:27 UTC


http://www.free-av.de .. like the URL say.. anti virus for free! :-)

[free ONLY for home usage!]

ID: 881552 · Report as offensive
Profile champ
Volunteer tester
Avatar

Send message
Joined: 12 Mar 03
Posts: 3642
Credit: 1,489,147
RAC: 0
Germany
Message 881576 - Posted: 2 Apr 2009, 6:51:22 UTC
Last modified: 2 Apr 2009, 7:03:09 UTC

I have got my experience with Avira. The free version is not really good. Long virus update times. (Or it is difficult to reach the download server).

The free version is Beta and is not able to detect all new viruses. This is why i have changed to Kaspersky. Since i am using it, i am virus free.
ID: 881576 · Report as offensive
Profile -=SuperG=-
Avatar

Send message
Joined: 3 Apr 99
Posts: 63
Credit: 89,161,651
RAC: 23
Canada
Message 881579 - Posted: 2 Apr 2009, 6:58:56 UTC
Last modified: 2 Apr 2009, 7:03:32 UTC

I have heard good stuff about Kaspersky. Lots of public interest too.. :)
Boinc Wiki




"Great spirits have always encountered violent opposition from mediocre minds." -Albert Einstein
ID: 881579 · Report as offensive
Previous · 1 · 2 · 3 · Next

Message boards : Number crunching : DownAdUp - Conficker Detection Software


 
©2025 University of California
 
SETI@home and Astropulse are funded by grants from the National Science Foundation, NASA, and donations from SETI@home volunteers. AstroPulse is funded in part by the NSF through grant AST-0307956.