W32/Conficker (all variants)
Top viruses and vulnerabilities in the wild
W32/Conficker is a worm with multiple variants. It exploits a buffer overflow vulnerability in the Server Service on Windows computers. McAfee Labs has named the most recently discovered variant of this worm W32/Conficker.worm.gen.d.
The original W32/Conficker.worm attacks port 445, the port that Microsoft Directory Service uses, and exploits Microsoft Windows vulnerability MS08-067. For instructions on how to download and apply the Microsoft Security Patch for this vulnerability, see Microsoft Security Bulletin http://www.microsoft.com/technet/security/Bulletin/MS08-067.mspx.
When the worm infects a system, it disables several critical security services including:
Windows Automatic Update
Windows Security Center
Windows Error Reporting
The W32/Conficker worm attaches itself to several prominent Windows processes including:
It also connects to a remote server for additional commands. It can receive instructions to propagate to other systems, gather personal information, or to download and install additional malware on the infected system.
See the Conficker- Note to Customers document attached to this article for more information and links to other resources.
IMPORTANT: See the Combating W32 Conficker worm document attached to this article for detailed information on detecting and removing the W32/Conficker.worm.
W32/Conficker.worm attack symptoms
Blocked access to security-related web sites
Traffic on port 445 on non-Directory Service servers
No access to admin shares
Autorun.inf files in recycled directory
When run, the worm copies itself using a random name to the %Sysdir% folder (where %Sysdir% is the Windows system folder, for example, C:\Windows\System32).
Some variants use these alternative file locations:
c:\documents and settings\all users\application data