The DOWNAD/Conficker Worm

Background
The first samples for the Conficker/Kido/DownadUp (detected by Trend Micro as WORM_DOWNAD.A) were discovered in November 2008 with new samples (detected as WORM_DOWNAD.AD and WORM_DOWNAD.KK) arriving in early 2009.  DOWNAD exploits a vulnerability in Windows that Microsoft patched (MS08-067) in October.

DOWNAD.AD added the ability to spread through network shares and removable storage devices (e.g. USB drives) using the AutoRun function in Windows. 

DOWNAD.KK shuts down security services, blocks infected computers from connecting to security websites, and downloads a Trojan. It also reaches out to other infected computers via peer-to-peer communications services, and includes an algorithm to update infected PCs.

What’s the goal of this worm?
It appears that the goal of this worm is to create a large botnet of infected PCs so that its creators may at some point send spam, steal personal information (user IDs, passwords, credit card info, etc.) and direct users to malicious websites used for phishing or downloading additional malware.

What’s happening on April 1st?
On April 1st, 2009, the latest variant (WORM_DOWNAD.KK) will begin to modify the way in which it communicates with other infected botnet nodes (PCs, servers), and will also increase the number of machines it attempts to contact in order to infect them.  There is no evidence that the worm will do anything beyond modifying its communications methods. 

How do I know whether my PC is infected?
For CKT Technology Management (TM) customers we are already confirming your patch levels and definition status to keep you as safe as posible and will be ready in case of infection.

On Call customers, or for any questions of concerns, please contact the help CKT helpdesk at helpdesk@ck-tek.com or 303-831-1101 for immediate assistance. 

For home users, you can your PC using your Trend Micro product or HouseCall to see whether you are infected.  If you discover that you are infected, find instructions for removal below:

• Consumers
• Small Business
• Medium Business, Enterprise

How do I protect my PC from being infected?

• Immediately install patches/updates for MS08067 and other vulnerabilities as soon as vendors release these patches.  Configure your PC to receive automatic updates and patches from Microsoft and software vendors.
• Make sure your security software is up to date.
• Disable the “Drive Auto-run” feature to avoid infections from USB drives.
• Employ secure passwords using a combination of letters, numbers and symbols and frequently change them.
• Take caution when searching online for DOWNAD and Conficker information.  There are reports of rogue antivirus packages that are taking advantage of the situation.  They will tell you that you are infected and ask you to pay money to download their application, which in many cases turns out to be malware.

Additional Information:

• Trend Micro CounterMeasures blog:  Downad/Conficker, who’s the April Fool?
• TrendLabs Malware Blog:  What Will Go DOWNAD on April 1?
• Latest Variant:  WORM_DOWNAD.KK

Additionally, this threat is an example of the new breed of Web threats being developed by cybercriminals who use multiple techniques and protocols to infect and propagate their attacks.  The Trend Micro Smart Protection Network blocks threats before they can enter your network and our correlated in-the-cloud web, email and file reputation databases allow us to quickly analyze and block new threats as they appear.  Smart Protection Network powers many of our consumer, SMB and Enterprise solutions today.  Email us today to learn more or to order or renew now and get protected! sales@ck-tek.com