The spread of Conficker

« « Conficker C Prevention | Manual Removal of conficker C » »

Tuesday, March 24th, 2009 Subscribe To Our Feed

Conficker.c .b .a, also known as Downadup is spreading fast. The simplest way to stop the spread is to ensure you have the latest Windows updates. This one simple tip can really help to stop the spread of Conficker. As well you need to make sure your antivirus client is up to date.

If you are using a free client then you do not have enough protection and we would recommend Spyware Doctor with Antivirus.

In just 4 days Conflicker.b went from 2.4 million infections to over 8.9 million infections. This was reported by F-secure.

According to F-Secure, recent variants of Conficker attach themselves to several processes, disable Windows security services such as Windows Defender, Windows Error Reporting Services, and others, and create a registry entry for faster propagation across a network.

As Symantec points out, the W32.Downadup.B variant not only exploit the original Windows Server Service RPC Handling Remote Code variation, but can also spread through infected USB flash memory drives and by cracking weak network passwords. These latter methods are widely used by Conficker/Downadup to attack corporate networks.

Conficker/Downadup.B also infects mapped drives with autorun.inf files that spread the worm and blocks DNS requests to security sites to prevent downloading of updated antivirus and antimalware programs.

Perhaps the scariest facts about Conficker, though, are these:

Conficker generates hundreds of domain names daily, but will only use a single one of the domains listed for downloading malicious files, making it very difficult to trace the actual infection sites.
Conficker’s payload - what it was designed to do - has not been triggered and is not yet known. What the developers of Conficker could do with millions of compromised PCs, the majority of which are on corporate networks, is frightening.

If you are already infected then you need to check with your security maker IE.. the maker of your security product. If you do not have a security product yet then you should consider Spyware Doctor with Antivirus.

In adition you may find these other tools helpful as well.