Thread: Three million hit by Windows worm

A worm that spreads through low security networks, memory sticks, and PCs without the latest security updates is posing a growing threat to users.

The malicious program, known as Conficker, Downadup, or Kido was first discovered in October 2008.

Although Microsoft released a patch, it has gone on to infect 3.5m machines.

Experts warn this figure could be far higher and say users should have up-to-date anti-virus software and install Microsoft's MS08-067 patch.

Right now, we're seeing hundreds of thousands of [infected]unique IP addresses

According to Microsoft, the worm works by searching for a Windows executable file called "services.exe" and then becomes part of that code.

It then copies itself into the Windows system folder as a random file of a type known as a "dll". It gives itself a 5-8 character name, such as piftoc.dll, and then modifies the Registry, which lists key Windows settings, to run the infected dll file as a service.

Once the worm is up and running, it creates an HTTP server, resets a machine's System Restore point (making it far harder to recover the infected system) and then downloads files from the hacker's web site.

INFECTED IPs WORLDWIDE
China 38,277
Brazil 34,814
Russia 24,526
India 16,497
Ukraine 14,767
Italy 13,115
Argentina 11,675
Korea 11,117
Romania 8,861
United States 3,958
United Kingdom 1,789
Source: F-Secure

Most malware uses one of a handful of sites to download files from, making them fairly easy to locate, target, and shut down.

But Conficker does things differently.

Anti-virus firm F-Secure says that the worm uses a complicated algorithm to generate hundreds of different domain names every day, such as mphtfrxs.net, imctaef.cc, and hcweu.org. Only one of these will actually be the site used to download the hackers' files. On the face of it, tracing this one site is almost impossible.

Speaking to the BBC, Kaspersky Lab's security analyst, Eddy Willems, said that a new strain of the worm was complicating matters.

BBCNews

I always find it amazing how many people though don`t bother to update their systems with free updates, many of them critical ones.

This sounds quite bad and i am lucky not to be infected...

I take my security very carefully, and make sure that everything is secured.

I just hope that this does not break out to much.

Viruses and worms and other malicious software or codes are nasty and should be stopped.

If only people had a little more common sense then they may not be infected.

~ Mike

Exclusive Staff at hospitals across Sheffield are battling a major computer worm outbreak after managers turned off Windows security updates for all 8,000 PCs on the vital network, The Register has learned.

It's been confirmed that more than 800 computers have been infected with self-replicating Conficker code. Insiders at Sheffield Teaching Hospitals Trust said they suspect many more machines are affected but have not been reported to IT.

The Trust told The Register it now has the outbreak under control and is engaged in "clearing up" remnants. Non-urgent appointments in the medical imaging department had to be cancelled while its computers were disinfected. A Trust spokeswoman said no other direct impact on patient care was known.

The decision to disble automatic security updates was taken during Christmas week after PCs in an operating theatre rebooted mid-surgery. Conficker was detected on December 29.

David Whitham, the Trust's informatics director, said in a statement: "We do not know how the virus entered the network but at around the same time as the virus became evident the automatic update process had been temporarily disabled following problems with a number of PCs in theatres.

"This decision was taken by the IT Change Advisory Board to prevent further disruption in theatres which could have affected patient care." No individual was responsible for the move, the Trust added.

People close to the incident criticised the management decision to disable updates across the entire network rather than only where the reboots caused a problem. "Don't you just hate it when your boss is so computer illiterate yet has the power to veto the simplest of ideas to catastrophic end," said one, who asked to remain anonymous.

Theregister.co.uk

This worm is a nightmare and is still around.

I recently removed this from a network of 800 machines.

Just make sure your machine is updated with the latest Windows updates and you have AV installed.