Category: Viruses and Spyware
Type: Malicious Behaviour
Aliases: WORM_DOWNAD.AD
W32/Conficker.worm
Worm:Win32/Conficker.gen!A
Worm:W32/Downadup
Net-Worm.Win32.Kido
Affected Operating Systems: Windows
Summary
Win32/Conficker is a worm that infects other computers across a network by exploiting a vulnerability in the Windows Server service (SVCHOST.EXE). If the vulnerability is successfully exploited, it could allow remote code execution when file sharing is enabled. Depending on the specific variant, it may also spread via removable drives and by exploiting weak passwords. It disables several important system services and security products and downloads arbitrary files
Symptoms
System Changes
The following system changes may indicate the presence of this malware:
The following services are disabled or fail to run:
•Windows Security Center Service
•Windows Update Auto Update Service
•Background Intelligence Transfer Service
•Windows Defender
•Error Reporting Service
•Windows Error Reporting Service
Some accounts may be locked out due to the following registry modification, which may flood the network with connections:
HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
"TcpNumConnections" = "0x00FFFFFE"
Users may not be able to connect to websites or online services that contain the following strings:
virus |
f-prot |
ikarus |
Removal
We would recommend following the below Sophos knowledgebase articles for removal instructions.
http://www.sophos.com/en-us/products/free-tools/conficker-removal-tool.aspx
http://www.sophos.com/en-us/support/knowledgebase/51169.aspx
