are you infected? how to check. (conficker/kido update) - Page 2

sabertooth · 01-26-2009, 09:57 PM

Quote:

Originally Posted by dmorris

I just updated it to point at untangle.com instead.

You may have to check your DNS settings.

I am very new to Untangle....

I am not sure what should be the DNS settings for this to work....
I am using Internal private IP of my Exchange/DNS server as my DNS on Untangle..
Please help.

sky-knight · 01-26-2009, 09:59 PM

0 rows returned. For both my networks...

And, surprisingly, 0 rows returned on my big client too.

sabertooth · 01-26-2009, 11:06 PM

0 rows for me too..

Got this command running buy changing the host name to IP address

However i would still be glad if someone gives a solution for the below.

Quote:

Originally Posted by sabertooth

I am very new to Untangle....

I am not sure what should be the DNS settings for this to work....
I am using Internal private IP of my Exchange/DNS server as my DNS on Untangle..
Please help.

Thanks again...

gpierides · 01-27-2009, 12:18 AM

thanks
great tip

amlife · 01-27-2009, 01:58 AM

I had a hard time with this worm, will try your command tomorrow ! thanks

girbot · 01-27-2009, 03:29 AM

Great post - I have bookmarked for future reference.

Got a nice 0 here too

dknyinva · 01-27-2009, 05:11 AM

Quote:

Originally Posted by dmorris

np - glad to help

The Kaspersky free utility couldn't find anything. I'll just restore a backup image using Acronis just to be safe.

Thanks again dmorris

dcbour · 01-27-2009, 05:47 AM

If you use any dyndns updater programs, you'll get a large number of hits on this site if you run the detail report, even though you may not be infected. I won't say you're not but keep this in mind.

dmorris · 01-27-2009, 10:44 AM

Quote:

Originally Posted by dcbour

If you use any dyndns updater programs, you'll get a large number of hits on this site if you run the detail report, even though you may not be infected. I won't say you're not but keep this in mind.

yeah, good point. this just looks at some suspicious sites visited. There could be other valid reasons to visit these sites...

dknyinva · 01-27-2009, 11:20 AM

Quote:

Originally Posted by dcbour

If you use any dyndns updater programs, you'll get a large number of hits on this site if you run the detail report, even though you may not be infected. I won't say you're not but keep this in mind.

Kaspersky free utility couldn't find anything, so I'm hoping you're right because I do have the dyndns client running checking hostname. I probably need to look closer at the 2nd curl command that dmorris posted and see the details date on when the checkip.dyndns.org.

01-26-2009, 09:59 PM	#12 (permalink)
sky-knight Join Date: Apr 2008 Location: Phoenix, AZ URLs submitted: 8 Posts: 14,698	0 rows returned. For both my networks... And, surprisingly, 0 rows returned on my big client too. __________________ Rob Sandling, BS:SWE, MCP Intouch Technology Phone: 480-272-9889 rob@intouchtechllc.com UntangleAppliances.com Phone: 866-794-8879

01-27-2009, 05:47 AM	#18 (permalink)
dcbour Master Untangler Join Date: Aug 2008 Posts: 109	checkip.dyndns.org -check for updater programs If you use any dyndns updater programs, you'll get a large number of hits on this site if you run the detail report, even though you may not be infected. I won't say you're not but keep this in mind.

01-27-2009, 12:18 AM	#14 (permalink)
gpierides Untangler Join Date: Sep 2007 Posts: 53	thanks great tip

01-27-2009, 01:58 AM	#15 (permalink)
amlife Master Untangler Join Date: Jan 2009 Location: Toronto,ON, Canada Posts: 106	I had a hard time with this worm, will try your command tomorrow ! thanks

01-27-2009, 03:29 AM	#16 (permalink)
girbot Master Untangler Join Date: Sep 2008 URLs submitted: 1 Posts: 105	Great post - I have bookmarked for future reference. Got a nice 0 here too