Spotlight On Malware: The Conficker Worm.

By popular request, here is a look at the Conficker Worm. This worm is also known as Downup, Downadup, and Kido.

First, Conficker sounds like a weird name. Where did it come from you ask? The origin of the name is thought to be a portmanteau of the English term configure and the German pejorative term Ficker. Conficker comes in 5 flavors, all of which we will talk about separately. The five flavors have been dubbed A, B, C, D, and E.

The first variant of Conficker (A) was discovered in early November of 2008. It spread through the Internet by exploiting a vulnerability in a network service (specifically MS08-067) on Windows 2000 through Server 2008. Windows 7 could have been affected, but during that time Windows 7 was in beta and the beta was not publicly available until January 2009. Although Microsoft released an emergency patch on November 23, 2008 to patch the vulnerability, a large number of PCs still remained unpatched as of January 2009. The final thing that Conficker A does is update itself to Conficker B, C, or D.

The second variant (B), discovered in December, added the ability to spread over LANs through removable media. The second variant also disabled Windows AutoUpdate and blocked certain DNS lookups. The final thing that Conficker B does is update to Conicker C or D.

The third variant (C) which was discovered in early February 2009 did much of the same stuff as Conficker B did. The final thing that Conficker C did was update itself to Conficker D.

Conficker D is where things get a little more interesting. This variant was discovered in March of 2009. It did what Conficker C did, however, it also added a few extra features such as disabling safe mode, and searching for processes that are related to anti-malware programs and killing them at one second intervals. The final thing that Conficker D did was download and install Conficker E.

Conficker E was discovered 3 days after Conficker D. It protected itself in the same manner as D (disabling anti-malware) and had a very interesting final payload. The final action was downloading and installing a spambot and SpyProtect 2009. Conficker E also removed itself on May 3 of 2009, leaving the copy of Conficker D still on the computer.

That is it for this Spotlight On Malware blog post. Once again, this was by popular request.... Now stop requesting it.