All You Ever Wanted to Know About Conficker

[Bob2002]

Conficker is one of a new interesting breed of self-updating worms that has drawn much attention recently from those who track malware. In fact, if you have been operating Internet honeynets recently, Conficker has been one very difficult malware to avoid. In the last few months this worm has relentlessly pushed all other infection agents out of the way, as it has infiltrated nearly every Windows 2K and XP honeypot that we have placed out on the Internet. From late November through December 2008 we recorded more than 13,000 Conficker infections within our honeynet, and surveyed more than 1.5 million infected IP addresses from 206 countries ...

http://mtc.sri.com/Conficker/

A very detailed breakdown of the Conficker worm and its variants and how they actually work. If you have a technical bent you'll find it extremely interesting.

 

[Sledgehammer]

Hi,

A very interesting read. What does conficker actually do to your PC? If you do have it on your PC is there any way to get rid of it, if anti-virus can't find it.

Ragards Paul.

 

[Bob2002]

What does conficker actually do to your PC?

From Wiki -

When executed on a computer, Conficker disables a number of system services such as Windows Automatic Update, Windows Security Center, Windows Defender and Windows Error Reporting.

It receives further instructions by connecting to a server. The instructions it receives may include to propagate, gather personal information and to download and install additional malware onto the victim's computer.[6] The worm also attaches itself to certain Windows processes such as svchost.exe, explorer.exe and services.exe.[7]

The worm seems to implement some of the ideas presented by Fucs, Paes de Barros e Pereira at the Blackhat Briefings Europe 2007, specifically: digitally signed additional payload, use of PRNG for communication and P2P communication.[8]

http://en.wikipedia.org/wiki/Conficker

Removal notes here - http://en.wikipedia.org/wiki/Conficker#Patching_and_removal

:hrmph:

 

[Captain_Cretin]

Duh!!