Using Linux to Detect Conficker
Wednesday, April 1st, 2009I’ve got this from LinuxJournal. And to make the story short, install nmap-4.85BETA5 (download here) and run the command with parameters:
nmap -PN -d -p445 –script=smb-check-vulns –script-args=safe=1 [network_range]
where network range is either 192.168.10.1-255 or 192.168.10.0/24
and look for the results containing:
Host script results:
| smb-check-vulns:
| MS08-067: FIXED
| Conficker: Likely INFECTED
|_ regsvc DoS: VULNERABLE
or better yet, use grep to filter INFECTED and VULNERABLE