Remember Conficker – and check your AV Definitions
With April 1st approaching (Wednesday of this week) and an unknown potential payload coming to potentially millions of computers, I felt it a good idea to get a post about conficker out to IT Managers.
Conficker is a worm that is essentially a time bomb, waiting for instructions on its next move, which many think will be April 1 2009. At this time, the creator of the worm could issue some command that could steal information from all of the computers that it is infecting, or they could do nothing.
CNet describes Conficker as follows:
“What is Conficker and how does it work?
Conficker is a worm, also known as Kido or Downadup, that cropped up in November. It exploits a vulnerability in Windows that Microsoft patched in October.
Conficker.B, detected in February, added the ability to spread through network shares and via removable storage devices, like USB drives, through the AutoRun function in Windows.
Conficker.C, which surfaced earlier this month, shuts down security services, blocks computers from connecting to security Web sites, and downloads a Trojan. It also reaches out to other infected computers via peer-to-peer networking and includes a list of 50,000 different domains, of which 500 will be contacted by the infected computer on April 1 to receive updated copies or other malware or instructions. Previous Conficker variants were written to connect to 250 domains a day. ”
Read more about Conficker on CNet
The Microsoft patch suggested for conficker can be downloaded here
The message of this post is not new or complex, but to simply remind everyone that conficker’s payload date is fast approaching and to make sure your organization’s systems are up to date with the latest malware protection.
Sometimes worms are big and problematic, but most outside of IT do not see them until they have a problem, conficker made 60 minutes this week.
