Conficker worm info

Comments/Suggestions
Post Reply
Revroy
Administrator
Administrator
Posts: 8549
Joined: Wed Sep 27, 2006 8:12 am
Contact:

Conficker worm info

Post by Revroy » Tue Mar 17, 2009 11:30 am

March 13, 2009 1:22 PM PDT
Latest Conficker worm gets nastier

by Elinor Mills


The authors of the latest variant of the Conficker worm are upping the ante against security vendors who are working to stop the spread and threat of the persistent program.
Conficker.C shuts down security services, blocks computers from connecting to security Web sites, and downloads a Trojan. It also is programmed to begin connecting to 50,000 different domains on April 1 to receive updated copies or other malware, as opposed to connecting to 250 domains a day as previous versions are doing, Ben Greenbaum, senior research manager for Symantec Security Response, said on Friday.
The authors of the code are "strengthening their hold on their collection of infected machines at the same time they are attempting to strengthen their ability to control those machines by moving to 50,000 domains," he said.
A self-described "cabal" of companies, including Microsoft, Symantec, and a host of domain registration providers, have been trying to thwart the efforts of Conficker by pre-registering and locking up the domain names being used by the worm to distribute updates.
Now that Conficker.C is targeting 50,000 domains, the group has its work cut out for it, Greenbaum said. Regardless, "it's unknown at this point whether (boosting the domains) is an effective sidestep around the cabal's actions," he said.
The worm, also called Kido or Downadup, was first detected in November and is believed to have infected more than 10,000 computers. The first two versions exploit a vulnerability that Microsoft patched in October.
The second variant, Conficker.B, was detected last month. It added the ability to spread through network shares and via removable storage devices, like USB drives, through the AutoRun function in Windows.
Among the domains targeted by Conficker was that of Southwest Airlines, which was expected to see an increase in traffic from the botnet on Friday, Sophos said last week. However, a Southwest spokesman said there had been no impact to the site from any additional traffic as a result of Conficker.
Experts are urging computer users to apply the Microsoft patch and update their antivirus software. And this week, Enigma Software Group and BitDefender announced free Conficker removal tools.
Conficker has proved to be such a nuisance that Microsoft has even offered a $250,000 reward for information leading to an arrest in the Conficker case.
Symantec has more technical and historical details on Conficker on their website...

Bolan
Administrator
Administrator
Posts: 5489
Joined: Tue Jan 09, 2007 4:29 pm
Contact:

Conficker worm info

Post by Bolan » Tue Mar 17, 2009 4:28 pm


chuff
Hero Member
Hero Member
Posts: 636
Joined: Fri Sep 07, 2007 1:49 am

Conficker worm info

Post by chuff » Thu Mar 26, 2009 1:25 pm

Great update - Thanks for the info - just a little too late for me.
I've just reformatted due to this B****d.
Hope it helps others.
Image

Life's too short - Only sweat the big ones.

Post Reply