conficker

It looks like all that updating Conficker did on April 1st and in the past few days had a reason: to push rogue anti-spyware software. According to several security software vendors, Conficker is dropping a program called SpywareProtect2009 on infected machines. The purpose of rogue anti-spyware programs is to scare users into paying for the software to clean up infections that the software itself has downloaded to the machine. Typically these programs will besiege the user with large pop-up windows proclaiming, in big red letters, that the computer is infected with hundreds of pieces of malware. If you receive any of these so-called warnings, don’t click on any of them. Run your security software (Norton, McAfee, Trend Micro, etc) to remove the threat. You can also go to any of the security vendors’ websites to get free removal tools for Conficker or any of the rogue anti-spyware programs. Check out our previous blog posts here for more information on Conficker and how to check for and remove it.

It’s been in the news recently, and we’ve talked about it here in previous posts and newsletters. The Conficker worm came to life yesterday according to TrendLabs, Trend Micro’s blog. It apparently downloads a file from other infected machines via P2P, similar to how file and music sharing services like Limewire work. From the TrendLabs blog:

Trend now detects this new Conficker variant as WORM_DOWNAD.E. Some interesting things (well at least in our perspective) found are:

1. (Un)Trigger Date – May 3, 2009, it will stop running
2. Runs in random file name and random service name
3. Deletes this dropped component afterwards
4. Propagates via MS08-067 to external IPs if Internet is available, if no connections, uses local IPs
5. Opens port 5114 and serve as HTTP server, by broadcasting via SSDP request
6. Connects to the following sites:
   • Myspace.com
   • msn.com
   • ebay.com
   • cnn.com
   • aol.com

It also does not leave a trace of itself in the host machine. It runs and deletes all traces, no files, no registries etc.

A particularly nefarious piece of malware has been in the news a lot lately: Conficker. Also known as Downadup and the April Fools worm, it is very sneaky and difficult to detect. Fortunately, because of its popularity, there has been a lot of research done to figure out ways to stop it from spreading and to remove it from machines that have been infected. The easiest way to determine if you have been infected with Conficker is to use the Conficker eye chart (available here). Part of Conficker’s programming is to block access to well-known security software vendors’ websites, such as Symantec and Trend Micro. The “eye chart” has a legend that explains what you should see if you don’t have Conficker, and also what you see if you do have Conficker. If the chart appears normal, then you most likely haven’t been infected; if there are some images missing, then you probably have Conficker. Don’t panic though, it can be fixed. You can access a list of steps to remove Conficker here, or you can give us a call. Even if you don’t have Conficker, make sure you have the latest version of your preferred security software and that it’s up-to-date. We recommend Norton Internet Security 2009 (available here).

So April 1st is here, and the end of the world has not been brought about by the Conficker worm… as far as we know. However, Conficker is still around, and if you are not sure whether or not you have it, it’s better to be safe. PC Magazine has put together a checklist of steps to make sure your machine is not infected; it’s available here. If you just want to download the scanning and removal tools, you can get them from the Conficker Working Group site here. And make sure you have installed the latest Windows updates and any updates for your security software (you DO have security software right?!?!?).

PS- This is NOT an April Fool’s joke.

Conficker (also known as Downadup) is a pretty nasty worm that has three known variations (A, B, and most recently C). It gets onto your machine through a Windows security flaw that was patched in October of 2008, and is programmed to call a sequence of control servers for updates and presumably other nasty activities. Recently, Kaspersky Labs, a security software and research company, was able to figure out the list of names the worm would check for updates and teamed with OpenDNS to block these attempts. Now researchers are saying that the worm is programmed to do something on April 1. What that is, they don’t know; they only know that it is set to “call home” on that day. Fortunately, there are many ways to remove the worm if you’ve been infected. And as always, keeping your antivirus and antispyware software up-to-date and installing Windows updates will help protect your machine.