You mean you're doubting it will be updated...right? Not sure how you could convince yourself it doesn't exist at all...

Ehtyar.

I'm not sure I understand exactly what kind of "proof" you need that's not already out there. Are you under the impression that the analysis of Conficker linked in the first post was made up?

Ehtyar.

Well it looks like it may have started to update to a new variant:
http://blog.trendmicro.com/downadconficker-watch-new-variant-in-the-mix/
https://forums2.symantec.com/t5/Malicious-Code/Downadup-Waledac/ba-p/393454#A260

It's a curious time to release the update, well assuming it's from the same people and not from someone else who has created a way to exploit Conficker itself.

The last two variants took about a month from their "activation" dates to be updated, this one is within 8 days.  I'm betting they've already reached the maximum infections and unless they refocus on infecting rather than updating, those numbers will continue to decline, so it makes sense to release the update sooner.

However, I'd think waiting just one more day would have been more beneficial with the Christian holiday and people having/taking off work.  It raises an interesting question of which spreads faster the actual updates or the news about the updates?

Why is it not foolproof? IMO that's a much easier way for users to detect to Conficker than attempting to download a tool from a site that Conficker blocks.

The reason why it isn't foolproof is there are some cases where it would fail to give correct results and you may see the images and still be infected.

Example: You might be using a proxy where the images are fetched from your ISP's cache, as would be the case if you are using something like AOL's TopSpeed service where all connections go through their proxy and they cache image files from sites that people visit and compress them to make them a smaller file size. It would be retrieved from the ISP's cache server rather than from the site hosting them if the cache already has the file. And it's based on image file URL and not IP, so no matter if Conficker is blocking the site or not, it comes from the cache which isn't blocked and doesn't know the image should be blocked from the user.

I am not sure, but I think Google also has a similar service and there is a plugin for both Firefox and IE (and it may be built into Chrome too), where the images are not compressed like AOL does, but they are served from Google's image cache (same one used for google's image searches). I am not sure if it works the same way as AOL's does, but it's possible that it too can cause a false negative on that Conficker Eye Test site.


^{BTW: Yes, it does make for much faster page load times and uses much less bandwidth for both the user and AOL, but that cache is an abomination that destroys art and causes all sorts of issues with images when the original site changes the image but it's not updated in the ISP's cache yet. In any AOL browser since v5 (released in the late 90's), it is turned on by default, and most people don't know it and don't know to turn it off. And it's not just dialup people that use it any more...a lot of broadband users are using it too.}

I am getting timeouts / "...cannot display web page".
Could be my security software/settings... trying to determine.
Thought I would confirm the links were valid first.

They work for me.

Quote from: bob99 on April 09, 2009, 02:52 PM

I am getting timeouts / "...cannot display web page".
Could be my security software/settings... trying to determine.
Thought I would confirm the links were valid first.

that itself might be a sign of Conficker infection.. the fastest way to check for infection is to get Sysinternals' "Process Explorer" and try to run it on your PC. Conficker would shut it down immediately, though it allows Windows' Task Manager.

Of course if you're infected, you won't be able to get to Microsoft.com...

Ehtyar.

Indeed. This part I don't quite understand though. It seems like a poor choice of avenues to make money, and for anyone on their toes it completely reveals the infection. I expected them to try spamming or something.

Ehtyar.