BEWARE!! Worm Alert ! Confliker – next one after Slammer!!

Win32/Conficker is a worm that spreads by exploiting the Microsoft Windows Server Service RPC Handling Remote Code Execution Vulnerability ( CVE-2008-4250 / CIVN-2008-170 ).  If the vulnerability is successfully exploited, it could allow remote code execution when file sharing is enabled.

The Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista and SP1, Server 2008, and 7 Pre-Beta allows remote attackers to execute arbitrary code via a crafted RPC request that triggers the overflow during path canonicalization, as exploited in the wild by Gimmiv.A in October 2008, aka "Server Service Vulnerability."

Win32/Conficker disables a number of system services such as Windows Automatic Update, Windows Security Center, Windows Defender and Windows Error Reporting and Internet connection sharing service.

It propogates by creating an autorun.inf file on all mapped drives so that it automatically executed as soon as the drive becomes accessible.

Screenshot of the autorun.inf file is pictured below(source :SANS)

 

Up on execution the autoplay window will pop up as given below

The first part, "Install or run program" is there because the autorun.inf file containing the shellexecute keyword. However, the text comes from the Action keyword and the icon is extracted from shell32.dll (the 4th icon in the file) which is the standard folder icon which will run the worm

The worm also monitors DNS requests to domains containing certain strings and blocks access to those domains so that it will appear that the network request timed out thereby restricting users from updating their security software from those websites.

Find the details: http://www.microsoft.com/security/portal/Entry.aspx?Name=Worm%3aWin32%2fConficker.A 

Use these FREE Removel Tools to prevent and clean up the system from the worm:

http://support.microsoft.com/kb/962007
ftp://ftp.f-secure.com/anti-virus/tools/beta/f-downadup.zip
http://www.symantec.com/security_response/writeup.jsp?
docid=2009-011316-0247-99

Prevention is better than cure. The following actions are advised in order to prevent infection from this Worm:

  • Disable autoplay/autorun features on all drives and devices.
  • Refer the following articles for relevant steps and patches:
    http://support.microsoft.com/kb/953252
    http://www.us-cert.gov/cas/techalerts/TA09-020A.html
  • Block ports 139 and 445 at the perimeter.
  • Install and maintain updated anti-virus software at gateway and desktop level
  • Install and maintain Desktop Firewall and block the ports which are not required
  • Use caution when opening attachments and accepting file transfers
  • Use caution when clicking on links to web pages
  • Refer the following Guidance articles from Microsoft for protection against Conficker worm.
    http://technet.microsoft.com/en-us/security/dd452420.aspx
    http://www.microsoft.com/protect/computer/viruses/worms/
    conficker.mspx
  •  

    References

    http://www.microsoft.com/security/portal/Entry.aspx?
    Name=Worm%3aWin32%2fConficker.A

    http://www.threatexpert.com/reports.aspx?find=W32.
    Downadup+&x=0&y=0

    http://blogs.technet.com/mmpc/archive/2008/11/25/
    more-ms08-067-exploits.aspx

    http://www.cert-in.org.in/vulnerability/civn-2008-170.htm
    http://www.cert-in.org.in/currentacts/currentact07.htm#TGAM
    http://www.ca.com/securityadvisor/virusinfo/virus.aspx?id=75911
    http://www.microsoft.com/technet/security/bulletin/ms08-067.mspx
    http://www.f-secure.com/weblog/archives/00001574.html
    http://www.f-secure.com/v-descs/worm_w32_downadup_al.shtml

    12 thoughts on “BEWARE!! Worm Alert ! Confliker – next one after Slammer!!”

    1. http://www.globallaptopbatteries.co.uk/acer/travelmate-2420-series.htm Acer travelmate 2420 series Battery http://www.globallaptopbatteries.co.uk/acer/white-aspire-one-zg5.htm Acer white aspire one zg5 Battery http://www.globallaptopbatteries.co.uk/apple/17-inch-powerbook-g4.htm Apple 17 inch powerbook g4 Battery http://www.globallaptopbatteries.co.uk/apple/a1189.htm Apple a1189 Battery http://www.globallaptopbatteries.co.uk/asus/a2000.htm Asus a2000 Battery http://www.globallaptopbatteries.co.uk/asus/a2500h.htm Asus a2500h Battery http://www.globallaptopbatteries.co.uk/asus/a3000.htm Asus a3000 Battery http://www.globallaptopbatteries.co.uk/asus/a32-f5.htm Asus a32-f5 Battery http://www.globallaptopbatteries.co.uk/asus/a32-s5.htm Asus a32-s5 Battery http://www.globallaptopbatteries.co.uk/asus/a4.htm Asus a4 Battery http://www.globallaptopbatteries.co.uk/asus/a4000.htm Asus a4000 Battery http://www.globallaptopbatteries.co.uk/asus/a42-a3.htm Asus a42-a3 Battery http://www.globallaptopbatteries.co.uk/asus/a42-a4.htm Asus a42-a4 Battery http://www.globallaptopbatteries.co.uk/asus/a42-v6.htm Asus a42-v6 Battery http://www.globallaptopbatteries.co.uk/asus/a42-w1.htm Asus a42-w1 Battery http://www.globallaptopbatteries.co.uk/asus/f3.htm Asus f3 Battery http://www.globallaptopbatteries.co.uk laptop batteries http://www.globallaptopbatteries.co.uk/asus/f5.htm Asus f5 Battery http://www.globallaptopbatteries.co.uk/dell/latitude-c400.htm Dell latitude c400 Battery http://www.globallaptopbatteries.co.uk/dell/inspiron-b120.htm Dell inspiron b120 Battery http://www.globallaptopbatteries.co.uk/dell/inspiron-b130.htm Dell inspiron b130 Battery http://www.globallaptopbatteries.co.uk/dell/latitude-d610.htm Dell latitude d610 Battery http://www.globallaptopbatteries.co.uk/dell/rn873.htm Dell rn873 Battery http://www.globallaptopbatteries.co.uk/gateway/12msb.htm Gateway 12msb Battery http://www.globallaptopbatteries.co.uk/dell/vostro-1000.htm Dell vostro 1000 Battery http://www.globallaptopbatteries.co.uk/dell/xps-m1210.htm Dell xps m1210 Battery http://www.globallaptopbatteries.co.uk/gateway/8msb.htm Gateway 8msb Battery http://www.globallaptopbatteries.co.uk/gateway/8msbg.htm Gateway 8msbg Battery http://www.globallaptopbatteries.co.uk/compaq/pavilion-dv2000.htm Compaq pavilion dv2000 Battery http://www.globallaptopbatteries.co.uk/compaq/pavilion-dv6000.htm Compaq pavilion dv6000 Battery http://www.globallaptopbatteries.co.uk/compaq/v6000.htm Compaq v6000 Battery http://www.globallaptopbatteries.co.uk/dell/1501.htm Dell 1501 Battery http://www.globallaptopbatteries.co.uk/dell/inspiron-1300.htm Dell inspiron 1300 Battery http://www.globallaptopbatteries.co.uk/dell/e1505.htm Dell e1505 Battery http://www.globallaptopbatteries.co.uk/dell/gd761.htm Dell gd761 Battery http://www.globallaptopbatteries.co.uk/dell/gk479.htm Dell gk479 Battery http://www.globallaptopbatteries.co.uk/dell/inspiron-1525.htm Dell inspiron 1525 Battery http://www.globallaptopbatteries.co.uk/dell/inspiron-2000.htm Dell inspiron 2000 Battery http://www.globallaptopbatteries.co.uk/dell/inspiron-2100.htm Dell inspiron 2100 Battery http://www.globallaptopbatteries.co.uk/dell/inspiron-2200.htm Dell inspiron 2200 Battery http://www.globallaptopbatteries.co.uk/dell/inspiron-5100.htm Dell inspiron 5100 Battery http://www.globallaptopbatteries.co.uk/dell/inspiron-5160.htm Dell inspiron 5160 Battery http://www.globallaptopbatteries.co.uk/dell/d400.htm Dell d400 Battery http://www.globallaptopbatteries.co.uk/dell/d5318.htm Dell d5318 Battery http://www.globallaptopbatteries.co.uk/clevo/d400.htm Clevo d400 Battery

    2. http://www.globallaptopbatteries.co.uk/compaq/dv1000.htm Compaq dv1000 Battery http://www.globallaptopbatteries.co.uk/compaq/dv2000.htm Compaq dv2000 Battery http://www.globallaptopbatteries.co.uk/compaq/dv2200.htm Compaq dv2200 Battery http://www.globallaptopbatteries.co.uk/compaq/dv4000.htm Compaq dv4000 Battery http://www.globallaptopbatteries.co.uk/compaq/dv6000.htm Compaq dv6000 Battery http://www.globallaptopbatteries.co.uk/compaq/dv6500.htm Compaq dv6500 Battery http://www.globallaptopbatteries.co.uk/compaq/hstnn-db42.htm Compaq hstnn-db42 Battery http://www.globallaptopbatteries.co.uk/compaq/n600.htm Compaq n600 Battery http://www.globallaptopbatteries.co.uk/compaq/n600c.htm Compaq n600c Battery http://www.globallaptopbatteries.co.uk/compaq/n610.htm Compaq n610 Battery http://www.globallaptopbatteries.co.uk/compaq/n610c.htm Compaq n610c Battery http://www.globallaptopbatteries.co.uk/compaq/nc4200.htm Compaq nc4200 Battery http://www.globallaptopbatteries.co.uk/toshiba/pa3285u-1bas.htm Toshiba pa3285u-1bas Battery http://www.globallaptopbatteries.co.uk/toshiba/pa3285u-1brs.htm Toshiba pa3285u-1brs Battery http://www.globallaptopbatteries.co.uk/toshiba/pa3285u-3bas.htm Toshiba pa3285u-3bas Battery http://www.globallaptopbatteries.co.uk/toshiba/pa3331u-1brs.htm Toshiba pa3331u-1brs Battery http://www.globallaptopbatteries.co.uk/toshiba/pa3395u-1brs.htm Toshiba pa3395u-1brs Battery http://www.globallaptopbatteries.co.uk/toshiba/pa3399u-1bas.htm Toshiba pa3399u-1bas Battery http://www.globallaptopbatteries.co.uk/toshiba/pa3399u-1brs.htm Toshiba pa3399u-1brs Battery http://www.globallaptopbatteries.co.uk/toshiba/pa3399u-2bas.htm Toshiba pa3399u-2bas Battery http://www.globallaptopbatteries.co.uk/toshiba/pa3399u-2brs.htm Toshiba pa3399u-2brs Battery http://www.globallaptopbatteries.co.uk/toshiba/pa3420u.htm Toshiba pa3420u Battery http://www.globallaptopbatteries.co.uk/toshiba/pa3421u-1brs.htm Toshiba pa3421u-1brs Battery http://www.globallaptopbatteries.co.uk/toshiba/pa3456u-1brs.htm Toshiba pa3456u-1brs Battery http://www.globallaptopbatteries.co.uk/toshiba/pa3465u-1brs.htm Toshiba pa3465u-1brs Battery http://www.globallaptopbatteries.co.uk/toshiba/pa3533u-1bas.htm Toshiba pa3533u-1bas Battery http://www.globallaptopbatteries.co.uk/toshiba/pa3533u-1brs.htm Toshiba pa3533u-1brs Battery http://www.globallaptopbatteries.co.uk/toshiba/pa3534u-1bas.htm Toshiba pa3534u-1bas Battery http://www.globallaptopbatteries.co.uk/toshiba/pa3535u-1bas.htm Toshiba pa3535u-1bas Battery http://www.globallaptopbatteries.co.uk/toshiba/pa3535u-1brs.htm Toshiba pa3535u-1brs Battery http://www.globallaptopbatteries.co.uk/hp/pavilion-dv2000.htm Hp pavilion dv2000 Battery http://www.globallaptopbatteries.co.uk/hp/pavilion-dv6000.htm Hp pavilion dv6000 Battery http://www.globallaptopbatteries.co.uk/toshiba/pa3285u-3brs.htm Toshiba pa3285u-3brs Battery http://www.globallaptopbatteries.co.uk/sony/vgp-bps2.htm Sony vgp-bps2 Battery http://www.globallaptopbatteries.co.uk/apple/a1185.htm Apple a1185 Battery http://www.globallaptopbatteries.co.uk/apple/a1185-black.htm Apple a1185 black Battery http://www.globallaptopbatteries.co.uk/apple/a1185-white.htm Apple a1185 white Battery http://www.globallaptopbatteries.co.uk/sony/vgp-bps2a.htm Sony vgp-bps2a Battery http://www.globallaptopbatteries.co.uk/sony/vgp-bps2b.htm Sony vgp-bps2b Battery http://www.globallaptopbatteries.co.uk/sony/vgp-bps2c.htm Sony vgp-bps2c Battery http://www.globallaptopbatteries.co.uk/toshiba/pa3536u.htm Toshiba pa3536u Battery http://www.globallaptopbatteries.co.uk/toshiba/pa3536u-1brs.htm Toshiba pa3536u-1brs Battery http://www.globallaptopbatteries.co.uk/hp/510.htm Hp 510 Battery http://www.globallaptopbatteries.co.uk/hp/6735.htm Hp 6735 Battery http://www.globallaptopbatteries.co.uk/hp/7400.htm Hp 7400 Battery http://www.globallaptopbatteries.co.uk/hp/b1900.htm Hp b1900 Battery

    Leave a Comment

    Fill in your details below or click an icon to log in:

    WordPress.com Logo

    You are commenting using your WordPress.com account. Log Out / Change )

    Twitter picture

    You are commenting using your Twitter account. Log Out / Change )

    Facebook photo

    You are commenting using your Facebook account. Log Out / Change )

    Google+ photo

    You are commenting using your Google+ account. Log Out / Change )

    Connecting to %s