Re: The Confiker Virus.

[Stefan <netfortius () gmail com>]

Just FYI - I had a pretty high ratio of properly conficker-infected
honeypots identified vs. false positives ratio, using nessus'
appropriate signature, whereas I could never get the py script to
properly run on my macbook pro ...

-- Stefan

On 3/30/09, JoeSox <joesox () gmail com> wrote:
> Has anyone tried the Python scs Network Scanner script?
> http://iv.cs.uni-bonn.de/wg/cs/applications/containing-conficker/
>
> I have installed Impacket-0.9.6.0 library but it throws the following
> warning
> "WARNING: Crypto package not found. Some features will fail."
>
> Does anyone know if this effects the reliability of the scs script? I
> have it scanning but I don't like that warning.
>
> What other library is Impacket looking for to correct that warning?
>
> --
> Thanks, Joe
>
>
> On Mon, Mar 30, 2009 at 10:27 AM, Paul Ferguson <fergdawgster () gmail com>
> wrote:
> > -----BEGIN PGP SIGNED MESSAGE-----
> > Hash: SHA1
> >
> >
> > Something folks might be interested in -- a way to detect
> > Conficker-infected hosts in your network:
> >
> > https://www.honeynet.org/node/389
> >
> > FYI,
> >
> > - - ferg
> >
> >
> > -----BEGIN PGP SIGNATURE-----
> > Version: PGP Desktop 9.5.3 (Build 5003)
> >
> > wj8DBQFJ0QDjq1pz9mNUZTMRAm7SAJ9MZo33Vok1uvyB4H7DML1gUKRlPQCggWtC
> > bL4g6kI0sc75IDu/fYzv8yI=
> > =HpOH
> > -----END PGP SIGNATURE-----
> >
> >
> > --
> > "Fergie", a.k.a. Paul Ferguson
> >  Engineering Architecture for the Internet
> >  fergdawgster(at)gmail.com
> >  ferg's tech blog: http://fergdawg.blogspot.com/

-- 
Sent from my mobile device

***Stefan
http://twitter.com/netfortius