Conficker Worm Detailed Information & Free Removal Tools

Conficker Worm Detailed Information & Free Removal Tools
Worm:Win32/Conficker.A is a worm that infects other computers across a network by exploiting a vulnerability in the Windows Server service (SVCHOST.EXE). If the vulnerability is successfully exploited, it could allow remote code execution when file sharing is enabled.

How Conficker Virus Installs in Windows?

This worm searches for the Windows executable 'services.exe' and will inject itself into it.
This worm copies itself to the Windows system folder as .dll where is a 5-8 character lowercase alphabetic name such as 'nxyme.dll'.
The worm adjusts the file time of the dropped DLL worm copy to the same as the system's kernel32.dll file time to mask forensic evidence of infection time. The registry is modified to execute the dropped DLL worm copy as a service.

Adds value: "DisplayName"
With data: "0"
To subkey: HKLM\SYSTEM\CurrentControlSet\Services\vcdrlxeu
Adds value: "ServiceDll"
With data: "\nxyme.dll"
To subkey: HKLM\SYSTEM\ControlSet001\Services\vcdrlxeu\Parameters

Once a machine has been infected the worm will patch the exploited function via a simple code hook in order to prevent re-infecting a machine it has already compromised. The worm opens and listens for connection attempts on a randomly chosen port between 1024 and 10000 and bypasses Windows firewall using APIs. The worm also stops the Internet connection sharing service.

It Spreads Via...

Networked Computers
Win32/Conficker.A copies itself into memory and begins propagating to random IP addresses across a network by exploiting a vulnerability in the Windows Server service (SVCHOST.EXE). If the vulnerability is successfully exploited, the worm instructs the target computer to download a copy of the worm from the host computer via HTTP protocol using the random port opened by the worm.
The worm uses the following URLs to determine the computer's geographic location:
getmyip.org
getmyip.co.uk
checkip.dyndns.org
Win32/Conficker.A avoids infecting Ukrainian located computers.


Payloads

1.Creates HTTP Server
The worm opens a random port between 1024 and 10000 and acts like a web server (HTTP server). If the remote machine is exploited successfully, the victim will connect back to the http server and download a worm copy.

2.Resets System Restore Point
The worm may call an API function to reset the computer's system restore point, potentially defeating recovery using system restore.

3.Downloads Files
If the date is after November 25, 2008, this worm will build a URL in the following format and attempt to download a file from it:
/search?q=%d&aq=7
If the date is after December 1, 2008 Win32/Conficker.A will attempt to download a file 'loadadv.exe' from the domain 'trafficconverter.biz'.

Top 10 Most Deadly Computer Virus In The World

A computer virus can cause a lot of destructive damage. VIRUS is an acronym which stands for Vital Information Resources Under Siege. Viruses are sometimes confused with worms and Trojan horses, which are technically different. So, I recommend you to read this article Difference Between a Virus, Trojan Horse and Worm. You just imagine how big organizations, governments, schools,businesses and IT sector were affected when certain viruses attacked their systems.

Computer Virus creates lots of problem in an organization which would result in millions, even billions of dollars in damages and losses. Though not all of these malicious computer programs are massively destructive, there are still some that have caused a lot of damage.Checkout, 6 Techniques used by malware composers to know more about malwares. Here are the top 10 most destructive computer viruses of all time.

1. Bagle
Bagle was detected in 2004, it infected users through an email attachment, and also used email to spread itself. Bagle did not rely on the MS Outlook contact list to make a list of where to send itself. It harvested email addresses from various document files stored in the infected computer – from plain-text files to MS Excel files. The danger of this virus was that its design opened a backdoor where a remote user could gain access and control of the infected computer. It could download additional components to either spy and steal information from the user or launch DDoS attacks to certain networks and computers.

2. Melissa
Melissa virus was made in 1999 by David L. Smith, created with Basic program, exactly with Microsoft Word macros. The Melissa virus was mass-mailing malware that was said to have infected up to 20 percent of computers worldwide. This virus spreads via email with the document “Here is That document you asked for, do not show it to anybodey else”. When this file will be opened or clicked it will automatically run the virus replication and automatically send a pass up to the top 50 in the address book of an email. Email servers around the world were forced to shut down in order to prevent the virus from spreading, as well as to remove the virus from their system.Smith was jailed 20 months and fined $ 5,000 and prohibited from accessing the computer without supervision.

3. Sasser
Creator by 17 year old German student, Sven Jaschan in 2004. Sasser attack Microsoft Windows. Sasser does not spread via email. The virus is usually spread through the network. It infected computers by exploiting vulnerability present in both Windows 2000 and Windows XP machines, known as the RPC (Remote Procedure Call) exploit. This will create a computer virus could not be shutdown without unplug the power. Jaschan Finally caught but he’s not jail, was only given probation 1 year 9 months, because at that time still under the age of 18.

4. ILOVEYOU a.k.a. Lovebug/Loveletter Virus
This virus started spreading in the Philippines, these virus classified as worm, which has the ability to do her own replication. Creator Onel de Guzman was from the Philippines. ILOVEYOU spread via email, with the title “love letters” from a secret admirer. Once opened, it loaded itself to the memory, infecting executable files. When a user received and opened the email containing the attachment “LOVE-LETTER-FOR-YOU.txt.vbs”, the computer became automatically infected. It then spread itself by infecting *.exe,*.jpg,*.mp3 files. After that, the virus sent itself to others by looking up the addresses contained in the MS Outlook contact list. The virus was written by a Filipino programmer who was still a college student at that time. He said the release of the virus was only “accidental.” This virus spread throughout the world in just a day, infecting computers of large corporations and governments, including the Pentagon in the United States. It caused billions of dollars in damages. The actual “damage” occurred during the removal of the infection from computers, as email servers and computer networks had to be shut down before the virus could be removed.His original file LOVE-LETTER-FOR-YOU.TXT. vbs.

5. MyDome
MyDome virus was detected in 2004. This virus is making a backdoor on the OS. Computer was first known attack on first February by doing DDoS. Then reported back to attack on the 12th of Feb, after that the virus stopped spreading and start creating backdoors. MyDoom spreads via email. MyDoom slowed down global Internet access by ten percent, and caused some website access to be reduced by 50%.

6. Leap-A/Oompa- A
Mac that has a concept of security through obscurity, Mac believe thea system can’t be infected by a virus of cause of the OS system is a closed. But in the year 2006, Leap-A virus or commonly known as Oompa-A appears and spreads via iChat on the Mac. Having a Mac attack, the virus will search for contacts via iChat and send messages to each contact. The message will contain a form of corrupt JPEG file. It’s not dangerous, but this proved that the Mac OS systems are not immune to the virus.

7. SQL Slammer
Appeared in January in the year 2003, spread quickly via the Internet. It caused a considerable amount of damage, though, by overwhelming routers, causing them to shut down. The target of this virus was web servers running a vulnerable version of Microsoft SQL Server. Upon infection of a server, the virus generated random IP addresses through which it attempted to further infect other computers.This virus has also been a U.S. Bank ATMs crash, the collapse of Seattle’s 911 service, and Continental Airlines.

8. Nimda
Reported attacks in 2001, call Nimda taken from opposite the word “Admin”. With its multi-pronged attack, Nimda appears to be the most troublesome virus of its type that has yet appeared. Its name (backwards for "admin") apparently refers to an "admin.DLL" file that, when run, continues to propagate the virus.These viruses spread very quickly, according to TruSecure CTO Peter Tippett, Nimda only takes 22 minutes to make the Top Ten Virus at the time. The main target of this virus is Internet servers, Nimda spread through Internet network by creating a backdoor into the OS.

9. Code Red
The world had not yet recovered from the damage caused by the ILOVEYOU virus when Code Red was released in simmer 2001.Code red virus attacks only Windows 2000 & NT OS. This virus will create a buffer becomes full so make the memory becomes full. Once a computer was compromised by the virus, it would modify the handled website, displaying the message “Welcome to http://www.worm.com! Hacked by Chinese!” Then, it would later seek other computers running the web server software and do the same thing. After about two weeks of infection, the virus was programmed to launch DDoS (Distributed Denial of Service) attacks on certain websites, including the server of the White House.

10. The Klez
This virus was first known infected on 2001, this virus spreads via email by conducting continuous replication, and sent to all email addresses in the victim’s address book. This virus makes the victim computer becomes very slow and can also turn off the antivirus application.