W32.conficker.worm - detection and blocking with a IPS 4235

We have an IPS 4235 system with IPS-K9-5.1-8-E3 Engine and sig file IPS-sig-s368-reg-E3 in fron of our Firewall. We also (unfortunately) have the w32.conficker worm which is causing a DDOS and flooding the network with TCP 445 traffic. We are trying to set up the IPS to block this traffic before it hits our Firewall so that we can restore external WAN links.
The IPS system sucessfully detects this 445 traffic as signature ID 1302 and fills the event log, but even though we have enabled "deny connection inline" in the "signature configuration" - it still does not seem to block the 445 traffic. Has anyone seen this before, and could they advise us on how to effectively block this traffic?

Hi,
Regardless of what the Signature fire's on you should still be able to set an action.
I could set it to fire on receiving any tcp syn and request a deny attack inline. If it is not working then I would question the configuration not the signature attribute.
A google search found this information regarding the worm. It seems to download a file via a random HTTP port. Perhaps you could look at using the AIC HTTP engine, and matching on the filename with a regex.
âThis malware mostly spreads within corporations but also was reported by several hundred home users. It opens a random port between port 1024 and 10000 and acts like a web server. It propagates to random computers on the network by exploiting MS08-067. Once the remote computer is exploited, that computer will download a copy of the worm via HTTP using the random port opened by the worm.â
Have you checked that there are no event action overrides configured that would overwrite your condition ?
Also have you ensured that the IPS is configured to never block certain address ranges ?
If you are seeing the signature fire then we can assume that the traffic flow has been setup correctly.
We cannot just block based on port 445 as we will be denying genuine RPC traffic. However we could customise the signature to fire based around a combination of the HTTP post or get. Or peer to peer RPC traffic.
HTH,
Jon Humphries
Nextiraone UK

Similar Messages

What UPS or AVR Does OS X Detect and Integrate with?

Hi. I think some UPS like the ones offered by APC support OS X software (OS X can detect and perform some stuff with it) using a separate (I may not have the USB slot for that anyway but I can make one free if that feature is really important). Are there any brands that supports OS X?
I'm not that interested in the UPS that has power backup coz' it's too expensive for the VA or wattage for my whole setupwhich includes other gadgets (like a Dremel, and 2 desk electric fans used for some crafts and hobbies) and it may not have as many as 8 outlets which I need. I'm more interested in a UPS brand that is as good as APC or even better at giving the iMac 27" i7 and the other gadgets quality electrict current. I already have a Belkin surge suppressor, do I only need an AVR (which might be too expensive) is the one I should combine the surge supressor with? Also I'd like to support smaller companies than APC that is as good (a kind of charity for the smaller but good companies to keep those smaller ones in business).
The maximum wattage all the gadgets including the iMac is around 635w (APC recommends in their calculator their UPS with 1000VA which is too costly).
I also read that we should avoid UPSes that only have a simulated or modified sinewave (the one to get should be the true sinewave but it's more expensive). What's the story on that?
I've seen other brands in order of availability AVR or UPS: FSP which seems to be designed in the US and is a US company, then there's Buffalo, Intex, Izuki, Voltac, Stac, Matsunaga, Stavor, Intex, Yaden, Cyberpower, Tripp-Lite,
Recommendations are welcome. Thank you in advance.
Gbu.

ummmm the problem is when i sync to Mobile Me my birthday dates change by a day (forward) e.g my birthday is the 8th and when i sync to Mobile Me and check online (www.me.com/contacts) my birthday date is ok, none of them have chage by a day
*BUT*
if i sync back down to another device it will change my birthday to the 9th. (even another mac, iphone, windows XP computer) all computers are set to New Zealand time zone.
(it always changes the dates of my birthdays every day of the week every time i sync. no error comes up it still syncs)
i dont think Mobile Me is offset. but i think in OS X it is.
so the time zone on Mobile Me would be +12 but the time zone in OS X would be offset so making +13
thats what im thinking in my head is that sounding right to you or am i way off haha
thanks for helping by the way.

Java Web Start and DNS with multiple IPs fails

We have a number of servers that deploy a Web Start application. We have a DNS entry with the 3 IPs of the servers (e.g. nslookup webstart.mydomain.com returns 3 different IPs).
This is fine for a browser (running a packet capture program e.g. Wireshark, will show each of the IPs getting tried until the file is returned).
The problem is with javaws - it only tries the first IP returned from the DNS, and if it isn't running it fails.
Does anyone know if there is a way to resolve this (makes it harder to fail over if our clients need different shortcuts)? (I assume that javaws just doesn't have the smarts to deal with this).
Maybe I need to add it to my Java 7 wish list.
Cheers,
David

We are trying to do the same thing for a different purpose. You need to set the override sooner than WebStart lets you... It has to be on the command line.
We are trying to overide the default nameservice because it uses reverse dns which is slow at some of our sites. We need to set the parameter
sun.net.spi.nameservice.provider.1=dns,sun before the VM starts using webstart. The only way we can do this is by setting the environment variable
JAVAWS_VM_ARGS=-Dsun.net.spi.nameservice.provider.1=dns,sun on the client. This is not real easy from the server side.
Is there any way we can make the client default to this nameservice provider? There must be some file somewhere on the client I can put this property in...

Security Vulnerabilities in LabVIEW DSC and Lookout - W32/Sdbot.worm

The LabVIEW DSC
module and Lookout install the Microsoft MSDE 2000 database. By default, the 'sa' password is left blank. Several viruses exploit this this known security vulnerability in MSDE 2000.
You can prevent infection by applying a secure 'sa' password to MSDE 2000.
Make sure the MSSQL Server service is running
Execute the following command line (replace new_password with the desired password):
osql -U"sa" -P"" -Q"sp_password NULL, 'new_password', 'sa'"
In particular, variants of the W32/Sdbot.worm virus are known to exploit this vulnerability.
Refer to this KB or the DSC Module readme for more information.
<http://digital.ni.com/public.nsf/websearch/42DFA4993437D7EE86256DE800570B39?OpenDocument>
~~

Ben wrote:
Thank you for getting the word out fast!
1) Which versions of LV DSC installed "MSDE 2000"?
2) How do I "Make sure the MSSQL Server service is running"?
3) How do I start " the MSSQL Server service "?
4) When you said "Execute the following command line " you mean go to Start >>>Run... and paste in the string you provided, correct?
5) If I am using a standard firewall from MacAfee or the like, should I expect a notification when the attack occurs?
Trying to be careful,
Ben
1) I believe all LabVIEW DSC systems since 7.0
2) You should see an SQL Server icon in the system tray and selecting it you will see a green arrow if it is running and a red square if it is not. If you have the full version of SQL Server installed or a version such as 2005 this might be different. In my case for the Microsoft SQL Server Development Edition I have a separate application called SQL Server Configuration Manager inside the start menu that shows an overview over this and other things.
3) Click on the icon in the system tray and select start, or go to above mentioned Configuration Manager if available or if you want to go on the deepest level go to the Administrative Tools Control Panel and select Services and in there make the SQL Server service started.
4) I would think a real command console to be a bit more appropriate as you can see the feedback if something went wrong.
5) If the Firewall is worth anything I would strongly expect this yes.
Rolf Kalbermatter
Message Edited by rolfk on 01-10-2007 10:58 PM
Rolf Kalbermatter
CIT Engineering Netherlands
a division of Test & Measurement Solutions

How do I take data from a query sample record and query another block with it?

I have a master/detail form (6i) that contains a master block (staff), and a detail block (phone). I would like to be able
to query by phone number, but when I execute the query, I would like a 'search results' box to pop up that contains the
phone number I queried for, as well as some other staff info. There might be multiple records that match my query,
and I'd like them all to be listed (or list 10 or so, with a scrollbar). I'd like a push button next to each record that will take
me back to the master/detail window with that record displayed. So, I created a third block that is based on a joined
view of the staff and phone tables. It is a multi-record block, with 10 recs displayed and a scrollbar. It is in a separate
window. I don't want the user to have to navigate to that block, however, to perform their query. I would like them to be
able to enter the query in the phone number block, then somehow grab the phone number they've entered and use it to
query my 'search' block. This is the part I'm having trouble with. Can someone please help? THANKS!

Where do I put that line of code? I see that it goes at the Script part near the top, but how can I use that, I am pretty new to this language. I am not familiar with this line, where does it bind the value from the datagrid to the variable?
fullXML[myDataGrid.selectedIndex].FIELD_NAME;
myDataGrid would be the id from the grid I am guessing?
and selected index would be the channel.description part?
and FIELD_NAME; is the variable name?
does this go into a funtion or is it placed at the top where the variables are declared?

On previous iPhones you could go to settings and block the the actual text message from pooping up. Only the sender would show up. On the i4gs the sender and message show up. This is a major flaw as far as privacy. There are no options with in settings to

On previous iPhones you could go to settings and block the the actual text message from pooping up. Only the sender would show up. On the i4gs the sender and message show up. This is a major flaw as far as privacy. There are no options with in settings to stop this from happening. PLEASE TELL ME IM WRONG ???

YOU ARE WRONG.
Go to Settings > Notifications > Messages. You can turn Notifcation Center off for Messages, or select None for the alert style, and turn Show Preview off, and view in Lock Screen on or off.

HT1414 Hello, do you know what I can do when my Iphone is blocked with the apple appearing ? I cannot enter into the phone and I don't know what to do ? Thank you

Hello,
Do you know what I can do when my Iphone is blocked with the apple appearing ?
I cannot enter into the phone and I don't know what to do ?
Thank you for your help
AMGSO

Basics from the manual are restart, reset, and restore.
Have you tried these?

I attempt to send an e-mail to an address in my Directory and it comes up in a pink block with a red circled exclamation point at the end. "Clicking" on the circle brings a pop-up saying the address is not registered for iMessages. How do I register ??

When I try to address an e-mail to an address in my iPad's Directory, the name comes up inside a pink block with a red circled exclamation point at the right hand end. "Clicking" on the red circle, gives me a pop-up saying the address is not registered for an iMessage. How do I register my Directory addresses for an iMessage??

Using FaceTime http://support.apple.com/kb/ht4319
Troubleshooting FaceTime http://support.apple.com/kb/TS3367
The Complete Guide to FaceTime + iMessage: Setup, Use, and Troubleshooting
http://tinyurl.com/a7odey8
Troubleshooting FaceTime and iMessage activation
http://support.apple.com/kb/TS4268
Using FaceTime and iMessage behind a firewall
http://support.apple.com/kb/HT4245
iOS: About Messages
http://support.apple.com/kb/HT3529
Set up iMessage
http://www.apple.com/ca/ios/messages/
Troubleshooting Messages
http://support.apple.com/kb/TS2755
Troubleshooting iMessage Issues: Some Useful Tips You Should Try
http://www.igeeksblog.com/troubleshooting-imessage-issues/
Setting Up Multiple iOS Devices for iMessage and Facetime
http://macmost.com/setting-up-multiple-ios-devices-for-messages-and-facetime.htm l
FaceTime and iMessage not accepting Apple ID password
http://www.ilounge.com/index.php/articles/comments/facetime-and-imessage-not-acc epting-apple-id-password/
Unable to use FaceTime and iMessage with my apple ID
https://discussions.apple.com/thread/4649373?tstart=90
For non-Apple devices, check out the TextFree app https://itunes.apple.com/us/app/text-free-textfree-sms-real/id399355755?mt=8
How to Send SMS from iPad
http://www.iskysoft.com/apple-ipad/send-sms-from-ipad.html
 Cheers, Tom

Hi, my daughter wrote wrong paswords in my ipod touch and it is blocked. It says it needs to be connected to itunes, but once its there it says the ipod is blocked with a passcode..the ipod is just blocked. what can I do?

hi, my daughter wrote wrong paswords in my ipod touch and it is blocked. It says it needs to be connected to itunes, but once its there it says the ipod is blocked with a passcode..the ipod is just blocked. what can I do?

Place the iOS device in Recovery Mode and then connect to your computer and restore via iTunes. The iPod will be erased.
iOS: Wrong passcode results in red disabled screen
If recovery mode does not work try DFU mode.
How to put iPod touch / iPhone into DFU mode « Karthik's scribblings
For how to restore:
iTunes: Restoring iOS software
To restore from backup see:
iOS: How to back up
If you restore from iCloud backup the apps will be automatically downloaded. If you restore from iTunes backup the apps and music have to be in the iTunes library since synced media like apps and music are not included in the backup of the iOS device that iTunes makes.
You can redownload iTunes purchases by:
Downloading past purchases from the App Store, iBookstore, and iTunes Store

Acrobat 7 mandatory update failing with error 16820 and blocking the use of the program

Acrobat 7 mandatory update failing with error 16820 and blocking the use of the program

Sorry I can't get the screen print to upload
It says
Mandatory Update Available
A Mandatory version of this application is available for download. Application can't continue without installing this version.
Application:     Acrobat_com
Installed version: 2.0.0.0
Update Version : 2.3.0.0
Download now                    Quit
Release notes ( this is blank)
After selecting 'Download Now' I get the following message;
     Download failed
     There was an error downloading the update. Error #16820
     Close

Error with internet plug-in message and blocked plugin

On my MacBook Air Im receiving a error with internet plug-in message and blocked plugin which will not allow video clips to play i.e. YouTube. How do I correct this?

When you have installed the latest version of Flash, relaunch Safari and test.
If you're getting a "blocked plug-in" error, then in System Preferences… ▹ Flash Player ▹ Advanced
click Check Now. Quit and relaunch your browser, but check this also:
http://support.apple.com/kb/HT5655?viewlocale=en_US&locale=en_US which also covers ‘blocked plug-in’.

Tried opening a file in library and it states can't open database with library name? It says Relaunch then will not open? and Blocks me completely from Aperture. I have to go to Finder to Rename it? I need this file how do I get it to open?

Tried opening a file in library and it states can't open database with library name? It says Relaunch then will not open? and Blocks me completely from Aperture. I have to go to Finder to Rename it? I need this file how do I get it to open?

Aftershotz,
You're going to have to give a bit more information.
What do you mean by "opening a file in library?" There is no function of Aperture to open files -- you can open (switch) libraries.
You'll have to be more specific about error messages, too. Perhaps some screenshots would be useful to diagnose your problem. "Can't open database with library name" is not enough detail about what Aperture is really telling you.
nathan

Hi ! My safari browser is blocked with the Ukash virus. And I can't select Safari Preferences Security. I'm also unable to reinitialize Safari. What should I do ?

Hi ! My safari browser is blocked with the Ukash virus. And I can't select Safari > Preferences > Security. I'm also unable to reinitialize Safari. What should I do ?

Force Quit .
Press command + option + esc keys together at the same time. Wait.
When Force Quit window appears, select the Safari if not already.
Press Force Quit button at the bottom of the window. Wait.
Safari will quit.
Relaunch Safari holding the shift key down.
For more on this:
http://www.thesafemac.com/fbi-ransomware-virus-rampant/

Hello every body .. my ipad blocked with icloud and i dont remember the email or even birthday i've wrote I just remember the security question ... what can i do in this case to restor my email working ?? thx

hello every body .. my ipad blocked with icloud and i dont remember the email or even birthday i've wrote I just remember the security questions ... what can i do in this case to restor my email back ?? thx

Do you mean that the iPad is on the activation screen ? If it is then does it not show the first letter of your email address and the provider e.g. similar to :
If that is what you are seeing then you don't remember any email account that you had starting with that letter with that provider ? If not then do you know if you have any of the account's downloads in your computer's iTunes library : Recovering a forgotten iTunes Store account name ?
Or see if you can find it via http://appleid.apple.com : Apple ID: How to find your Apple ID
If you cant remember or find your id then you won't be able to use your iPad

What is the risk, and how to detect, Trojan infection with Flashback/Flashfake? (PowerMac G5 OS X 10.5.8)

What is the risk, and how to detect, Trojan infection with Flashback/Flashfake? (PowerMac G5 OS X 10.5.8)

Hey Kappy, without even looking I can tell you anything is better than the GeForce4MX cards, but see
See japamacs page here on the best AGP cards for G4s & G5s...
http://www.jcsenterprises.com/Japamacs_Page/Blog/4B4B7BA2-7ABB-47F1-87AC-B03D379 42BEE.html
Rated slowest on top, fastest on bottom, hopefully japamac will drop in shortly.
Oh, & they need way more RAM...
http://www.everymac.com/systems/apple/powermac_g4/specs/powermac_g4_933_qs.html
http://eshop.macsales.com/MyOWC/Upgrades.cfm?sort=pop&model=155&type=Memory

W32.conficker.worm - detection and blocking with a IPS 4235

Similar Messages

Maybe you are looking for