NWA-PCUG Newsletter Article, May 2009
What We Learned From the Conficker Worm
By Ira Wilsker, APCUG Director;
Columnist, The Examiner, Beaumont, TX; Radio & TV Show Host

(click to email author)

http://www.malwarebytes.org MalwareBytes
http://www.emsisoft.com/en/software/free/ a-squared Free
http://www.f-secure.com/weblog/archives/00001636.html F-Secure Information
http://www.microsoft.com/protect/computer/viruses/worms/conficker.mspx Microsoft
http://www.microsoft.com/protect/images/viruses/diagram.jpg Conficker Diagram
http://www.dshield.org/conficker Third party removal tools
http://www.confickerworkinggroup.org/wiki/ Conficker Working Group
http://www.confickerworkinggroup.org/infection_test/cfeyechart.html Eye Chart
http://en.wikipedia.org/wiki/conficker Conficker information
http://bdtools.net BitDefender Conficker utilities

On April 1, “April Fools’ Day”, the globe held its collective breath to see what, if anything, the Conficker worm would do to the millions of computers that it infected. No less a mass media authority than the CBS news show “60 Minutes” broadcast a warning on the Sunday evening prior to the April 1 “activation” of the Conficker worm. Some local and national media tripped over each other trying to get out stories and interview geeks and nerds (me included) about what was going to happen, and then what happened after the April 1 trigger date passed.

Conficker is a computer worm that can infect a vulnerable computer via a network connection or infected flash drive, and there have been some anecdotal claims of infection from visiting infected websites, but this vector has been challenged by some security experts. There are at least four distinct variants of Conficker, appropriately given the suffixes “A” through “D”. Each variant has slightly different methods of transmission, with the latter variants being more potentially harmful than the earlier ones. The earliest version, Conficker A, was discovered in the wild on November 21, 2008, and exploited Windows computers that did not have the latest security patches installed (specifically MS08-067), which left open a vulnerability on unpatched computers. The “A” variant did little to protect itself from detection and eradication, but later versions incorporated protective capabilities that rendered many of the detection and removal methods ineffective. The “D” variant, which first appeared on March 4, 2009 implemented sophisticated techniques to protect itself from detection and neutralization. The “D” version would prevent the internet web browser from connecting to most of the anti-malware websites, disabled the auto-update function of Windows, and would scan running processes every second looking for anti-malware utilities, patches, or diagnostic utilities that could detect Conficker, and try and terminate it, thus protecting itself from detection and removal. This ability to protect itself created a cat-and-mouse game between the creators of Conficker and the cyber security community who were actively trying to defeat Conficker.

The variants of Conficker have a nasty habit of receiving mutation and update instructions from up to 500 new web domains daily, out of up to 50,000 newly created web domains created by Conficker daily. The organizations that manage the top level domain names have done a lot to cripple the effect of Conficker creating so many domain names, thus making it easier to cripple the ability of Conficker to “phone home” for instructions and updates. The reason why so many pundits were concerned about April 1 was that Conficker D was to “phone home” for instructions, and no one other than the Conficker administrators, knew what those instructions would be. There were predictions of massive spam attacks shutting down mail servers, denial of service attacks, massive identity theft, and other malevolent activities, but April 1 passed without any major maladies being attributed to Conficker. That does not necessarily mean that Conficker is dead, but simply sitting dormant on millions of infected computers just listening for instructions to do something malevolent.

One point of difference was on the number of computers infected by Conficker, with the media often using the number 10 million. Different cyber security organizations arrived at different numbers using a variety of techniques. Panda, the Spanish publisher of security software, reported that 6% of the 2 million computers scanned with its online active scan service were infected with Conficker. IBM analyzed the number of computers “phoning home” through the networks, and came up with the prediction that 4% of all PCs were infected, which could put the number into the tens of millions. Other prognosticators arrived at number of Conficker infected computers at between 9 and 15 million. What is so potentially threatening about this large number of infected computers, regardless of the actual number, is that they all have the capability of be remotely administered as part of an army of zombies, in a super computer like network of robots, known as a “botnet”, which can launch some type of concerted action upon the orders of the “botmaster”.

The computer security industry did not sit idly by as Conficker spread. On February 13, 2009, Microsoft posted a $250,000 reward for information leading to the arrest and conviction of individuals behind the creation and distribution of Conficker. Many of the security companies came together and created the Conficker Working Group (http://www.confickerworkinggroup.org) as a centralized repository of Conficker data, detection and removal information. The working group released a very fast and effective, but simple, online detector that anyone can use to quickly determine if his computer is infected with Conficker. The working group calls it the “Conficker Eye Chart”, which is nothing but a simple website that displays the logos of several of the security companies that Conficker blocks; if the logos display, the computer is likely clean of Conficker, but if any of the logos fail to display, the computer is likely infected by Conficker or another miscreant that blocks access to security companies sites. This eye chart, which should be visited by all PC users, is online at http://www.confickerworkinggroup.org/infection_test/cfeyechart.html.

I carry several utilities on a flash drive that I have used several times in recent days to scan suspect computers. I carry MalwareBytes (http://www.malwarebytes.org) along with its latest update, and a-squared FREE (both the full version and the version that will run from a USB drive), which I use to scan suspect computers. I found that a-squared FREE can detect more than MalwareBytes, because a-squared FREE will detect both viruses and other forms of malware, while MalwareBytes only detects malware, but not viruses. Both will detect and kill Conficker. There is a comprehensive interactive directory of anti-Conficker utilities at http://www.dshield.org/conficker. I also carry BitDefender’s two Conficker specific detection and removal tools (BDTools.net), one if which is for PCs, and the other will detect Conficker on a network. While there are several other free Conficker utilities available, I have been satisfied with these few.

While Conficker did not cause Armageddon on April 1, as some in the mass media had predicted, it is still sitting on countless millions of infected computers, just waiting for commands. I strongly suggest that PC users perform a scan with one or more of the utilities referenced above. If your browser will not connect to one of the major security websites, your computer is likely infected with Conficker or some other self-protecting malware. Connect to the “eye chart” mentioned above, and see if you can access the security sites. If you cannot connect and display the logos of the security companies, then your computer is infected with something bad. It is also possible that the antivirus software installed on your computer has been crippled by Conficker or some other malware, and may need to be reinstalled after the computer is cleaned with a third-party utility, such as a-squared FREE.

Users should not be complacent, as millions are unknowingly infected with viruses and malware. It would be very wise and prudent to scan your computer right now with a reputable third party product just to be sure.

Click here to return to top