10 M+ Conficker Worm Infections Prepare for April 1 Update

20,023 Views

Featured Author:

DailyTech

DailyTech is a leading online magazine for a well-educated, tech audience. Its readers enjoy hard-hitting and up to the minute CE, PC, IT and information technology news. DailyTech’s fast-moving content also reaches out via news syndications, public portals, and forums.

More articles from this author:

‘The worm that won’t go away will get an upgrade on April 1.’ -

The Conficker worm has been wreaking havoc on internet users ever since it climbed out of its slimy hole in the internet’s dark nether-regions back in 2008. Now the worm is about to get even more dangerous when it receives its latest refresh in a series of periodic updates on April 1. Security officials are bracing for the impact that the upgrade might have.

Either diabolical or brilliant, it’s the Conficker worm’s unique design that allowed it infect over 8 million business computers last year and scores of other individual users. The worm, like many viruses, is regularly evolving thanks to periodic downloads. However, the techniques it uses to do so are rather unique — it cleverly creates thousands of false domains daily to throw off investigators. On the update day, it selects 500 correct domains out of the 50,000 candidates to download malware and updates from.

Pierre-Marc Bureau, a researcher at Eset says that this has helped the virus evolve from an initial novice-seeming threat targeting a flaw in Windows services into a large scale menace. States Mr. Bureau, “From a high-level perspective, the ‘A’ variant gave the impression [of being] a ‘test run’. It had code that probably was not meant to be spread globally. For example, it was checking for the presence of an Ukrainian keyboard or Ukrainian IP before infecting a system.”

The first run also contained a false lead — it tried to download and execute a file called loadav.exe. This led security research to believe it was just one of a pack of malware programs trying to peddle fake antivirus software. It turned out to be a red herring — the file was never uploaded and the next generation did away with the feature.

In the second version, the worm continued to spread through Windows Services on unpatched machines. However, the update also granted it the power to spread over network shares by trying to log in autonomously into network machines with weak passwords. It also gained the ability to load itself onto USB sticks connected to infected machines, gaining another means of transmission. The scanning speed for machines to infect was greatly optimized — in short the worm had become a real big problem.

« Previous 1 2 Next »

Share this Article: Digg It! Stumble It! Reddit Facebook Technorati

money

6 months ago

74 comments

This worm was a pain in the ass. The problem is the domains it throws need to have a querry. So why dont they check it? It has to be recieveing info from somewhere? I know they are sneaky bastereds. I no someone hwo had this this year in thier work network. We found the virus hiding inside of a jpeg image.
Avenger1432

7 months ago

10 comments

jumptech... chances are Norton (piece of crap) will miss something. Avast, which is free, beats out Norton in tests.... it has won so many awards. Avast also is the only free antivirus that also offers Boot-time scanning, very effective if you have a boot-virus or one in the memory... also, you boost that protection with ThreatFire.... (improves your detection rate HUGE, look it up), that with Spybot and Lavasoft Ad-aware... should make your computer as safe as your husbands mac (given that you update the anti-spyware regularly) and most things you wont have to disable avast to run those services.. maybe a anti-virus service like the web scanner... or a provider.. 7 different services you can disable instead of the whole thing..

You could also try malwarebytes anti-spyware... i have not really used it but supposedly it is on the top of the list.
M_Witham

7 months ago

26 comments

Too many people had a heart attack about this, I will say it was either profoundly genius the way it was designed, or just an intelligent accident. The people that wrote the worm need to be highly paid to stop others from doing the same thing.
mtime09

7 months ago

2 comments

it only works if your system is not updated and you have no anti-virus. all and all i would like to meet the writers of this worm they would have to be really smart its amazing
jumptech

7 months ago

2 comments

I use my husbands mac for anything purchased or pay bills ect, If my Norton 360 misses anything I will join the growing Apple community and pay the extra for the Notebook. Having 34 years with AT&T I know these companies sell access to your privacy. Including AT&T. Have first hand witnessed a bill collection agency,Using the info they have to invade and steal identity and have a Identity protection company they sell right there in the same room with their collection agency. ( I was working on their phone system and overheard the scam) WHAT I AM SAYING IS...OUR SECURITY is sold out for Merchant profit.One way you know if a company is selling you out...IF a virus protection must be disabled for you to gain access....Like oh, say NORTON will not allow some telco digital line subscriber services to work properly, so you must disable it..In order to use that company's internet service.
Avenger1432

7 months ago

10 comments

Well I don't know about you guys... but I just dual boot my system with Vista and Linux, If my vista gets messed up, I just move to my linux partition, install Avast for linux... and scan and destroy that worm (whenever the definitions are updated to do so) (or ClamAV... or whatever I can find...) and anti spyware stuff using windows programs on linux (Wine)
reidlowe

7 months ago

6 comments

Although i've used a PC for years, I moved to a Mac for my personal stuff back in November...I'll sit out this virus and watch
Revo

7 months ago

2 comments

I just created a worm that will hopefully cancel out the effects of the Conficker.
Account Removed

7 months ago

http://www.us-cert.gov/current/current_activity.html#conficker_worm...
JoeBuddha

7 months ago

6 comments

Anti worm. Not bad!

Oh, and the anti-Microsoft crap? If I was a virus or worm writer (and I'm not, for the record), I'd target the largest installed base I could. Linux and Apple? If they were the top of the food chain, they'd be targeted as well (and as successfully).
richard60

7 months ago

2 comments

have you herd of I YOGI.COM? thats who helps me wiht all this stuff. or i would never get it right.
Account Removed

7 months ago

I yank all my hard drives, replaced it by "new" ones twice the capacity and migrated my profiles and documents + re-installed all the software, it leaves me less chance to be infected. It took me 2 days to do this. LOL!! And I can re-image them with the fresh images, so I'm ready ;-)
UnkieBo

7 months ago

1040 comments

Be sure that you have your antivirus and windows updates all in place!
czar

7 months ago

252 comments

My daughter was fed this virus from an internet site when she tried to get "Spybot search and destroy". (She mistakenly clicked on a phony) I had mentioned I was going to install it as a back up along with Malwarebytes anti-malware combined with Norton Internet security as a three pronged approach to protecting systems, this was how I was protecting my network, and a couple of clients. It really cleans out the crap. You let Norton run and execute the two others manually once a week. This "security" setup works quite well BTW. She was 150 miles away at college, and pretty damn good on a computer she just got fooled like lots of other out there.

She called me when her system started acting erratically. She had Norton internet Explorer on her system but since she clicked and allowed the installation it was let in. She knew by the end of the day she had done something wrong and tried it uninstall this fake "spybot" it spread across her system and opened every port AND it defeated Norton with some kind of anti-Norton code, she was so upset she drove home.

I made a non rewritable DVD to run a updated Norton, Malwarebytes anti-malware, search and destroy I also used a program called "hijackthis" and manually went in and deleted files from the registry along with other places. My god this thing was everywhere there were 182 infected files when I rebooted it it reappeared in about 15 places; I manually deleted those after running those programs again. Once more all the antivirus programs said the system was clean.

After rebooting it wasn’t. I decided to wipe it, take it back to its original configuration (two month old HP notebook) I pulled off her user files with an external drive, I hoped that since there was no operating system It would not become infected or eventually one of these Antivirus companies would figure out how to eradicate this insidious beast. With twenty plus years in the computer industry I had never seen anything like it.

When I tried to run the rebuild partition it got to 90% and hung and wouldn’t start again, I ran the hard disk tool it said the drive was ok. So I ordered the CD's from HP ; when running the first disk it tried to delete the existing partitions then crashed and the hard drive died. HP replaced it but I am not 100% sure that it wasn’t the viruses that killed it.

Be aware this thing maybe a Hard drive killer too.
pratikf

7 months ago

26 comments

That picture makes it look scary. Three cheers to Windows Update.