Win32/Conficker.AA removal

Win32/Conficker.AA removal - just run it to remove it... or check if you have it Threat Encyclopaedia Print this pageSend Win32/Conficker.AA Aliases: Trojan.Win32.Agent.bbof (Kaspersky), W32.Downadup.B (Symantec), WW32/Conficker.worm.gen.a (McAfee) Type of infiltration: Worm Size: 157130 B Affected platforms: Microsoft Windows Signature database version: 3730 (20090101) You can download the removal tool here . Short description Win32/Conficker.AA is a worm that spreads via shared folders and on removable media. It connects to remote machines in attempt to exploit the Server Service vulnerability. Installation When executed, the worm copies itself in some of the the following locations: * %system%%variable%.dll * %program files%Internet Explorer%variable%.dll * %program files%Movie Maker%variable%.dll * %appdata%%variable%.dll * %temp%%variable%.dll A string with variable content is used instead of %variable% . The worm loads and injects the %variable%.dll library into the following processes: * explorer.exe * services.exe * svchost.exe The worm registers itself as a system service with the name combined from the following strings: * Boot * Center * Config * Driver * Helper more... * Boot * Center * Config * Driver * Helper * Image * Installer * Manager * Microsoft * Monitor * Network * Security * Server * Shell * Support * System * Task * Time * Universal * Update * Windows under... In order to be executed on every system start, the worm sets the following Registry entry: * [HKEY_CURRENT_USERSoftwareMicrosoftWindowsCurrentVersion Run] * "%variable_name%" = "rundll32.exe "%system%%variable%.dll", %random_string%" The following Registry entries are set: * [HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServices%random service name%Parameters] "ServiceDll" = "%system%%variable%.dll" * [HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServices%random service name%] "Image Path" = "%System Root%system32svchost.exe -k netsvcs" more... * [HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServices%random service name%Parameters] "ServiceDll" = "%system%%variable%.dll" * [HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServices%random service name%] "Image Path" = "%System Root%system32svchost.exe -k netsvcs" "DisplayName" = "random service name%" "Type" = 32 "Start" = 2 "ErrorControl" = 0 "ObjectName" = "LocalSystem" "Description" = "%variable_name%" * [HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpip Parameters] "TcpNumConnections" = 16777214 * [HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows CurrentVersionexplorerAdvancedFolderHiddenSHOWALL] "CheckedValue" = 0 * [HKEY_CURRENT_USERSOFTWAREMicrosoftWindowsCurrentVersion Applets] "gip" = 0 * [HKEY_LOCAL_MACHINESOFTWAREMicrosoftWindows CurrentVersionApplets] "gip" = 0 under... A string with variable content is used instead of %random service name% . The following Registry entries are deleted: * [HKEY_LOCAL_MACHINESoftwareMicrosoftWindows CurrentVersionexplorerShellServiceObjects {FD6905CE-952F-41F1-9A6F-135D9C6622CC}] "wscsvc" = "%filepath%" * [HKEY_LOCAL_MACHINESoftwareMicrosoftWindows CurrentVersionRun] "Windows Defender" = "%filepath%" Spreading The worm starts a HTTP server on a random port. It connects to remote machines to port TCP 139, 445 in attempt to exploit the Server Service vulnerability. If successful, the remote computer may attempt to connect to the infected computer and download the copy of the worm . This vulnerability is described in Microsoft Security Bulletin MS08-067 . Spreading via shared folders The worm tries to copy itself into shared folders of machines on a local network. The following usernames are used: * %username% The following passwords are used: * 123 * 1234 * 12345 * 123456 * 1234567 more... * 123 * 1234 * 12345 * 123456 * 1234567 * 12345678 * 123456789 * 1234567890 * 123123 * 12321 * 123321 * 123abc * 123qwe * 123asd * 1234abcd * 1234qwer * 1q2w3e * a1b2c3 * admin * Admin * administrator * nimda * qwewq * qweewq * qwerty * qweasd * asdsa * asddsa * asdzxc * asdfgh * qweasdzxc * q1w2e3 * qazwsx * qazwsxedc * zxcxz * zxccxz * zxcvb * zxcvbn * passwd * password * Password * login * Login * pass * mypass * mypassword * adminadmin * root * rootroot * test * testtest * temp * temptemp * foofoo * foobar * default * password1 * password12 * password123 * admin1 * admin12 * admin123 * pass1 * pass12 * pass123 * root123 * pw123 * abc123 * qwe123 * test123 * temp123 * mypc123 * home123 * work123 * boss123 * love123 * sample * example * internet * Internet * nopass * nopassword * nothing * ihavenopass * temporary * manager * business * oracle * lotus * database * backup * owner * computer * server * secret * super * share * superuser * supervisor * office * shadow * system * public * secure * security * desktop * changeme * codename * codeword * nobody * cluster * customer * exchange * explorer * campus * money * access * domain * letmein * letitbe * anything * unknown * monitor * windows * files * academia * account * student * freedom * forever * cookie * coffee * market * private * games * killer * controller * intranet * work * home * job * foo * web * file * sql * aaa * aaaa * aaaaa * qqq * qqqq * qqqqq * xxx * xxxx * xxxxx * zzz * zzzz * zzzzz * fuck * 12 * 21 * 321 * 4321 * 54321 * 654321 * 7654321 * 87654321 * 987654321 * 0987654321 * 0 * 00 * 000 * 0000 * 00000 * 00000 * 0000000 * 00000000 * 1 * 11 * 111 * 1111 * 11111 * 111111 * 1111111 * 11111111 * 2 * 22 * 222 * 2222 * 22222 * 222222 * 2222222 * 22222222 * 3 * 33 * 333 * 3333 * 33333 * 333333 * 3333333 * 33333333 * 4 * 44 * 444 * 4444 * 44444 * 444444 * 4444444 * 44444444 * 5 * 55 * 555 * 5555 * 55555 * 555555 * 5555555 * 55555555 * 6 * 66 * 666 * 6666 * 66666 * 666666 * 6666666 * 66666666 * 7 * 77 * 777 * 7777 * 77777 * 777777 * 7777777 * 77777777 * 8 * 88 * 888 * 8888 * 88888 * 888888 * 8888888 * 88888888 * 9 * 99 * 999 * 9999 * 99999 * 999999 * 9999999 * 99999999 under... If successful the following filename is used: * \%hostname%ADMIN$System32%variable%.dll The worm schedules a task that causes the following file to be executed daily: * rundll32.exe %variable%.dll, %random_string% Spreading on removable media The worm copies itself into existing folders of removable drives. If successful the following filename is used: * %drive%RECYCLERS-%variable1%%variable2%.%variable3% A string with variable content is used instead of %variable1-3% . The worm creates the following file: * %drive%autorun.inf Thus, the worm ensures it is started each time infected media is inserted into the computer. Other information The following services are disabled: * Windows Security Center Service (wscsvc) * Windows Automatic Update Service (wuauserv) * Background Intelligent Transfer Service (BITS) * Windows Defender Service (WinDefend) * Windows Error Reporting Service (ERSvc) * Windows Error Reporting Service (WerSvc) The worm launches the following processes: * netsh interface tcp set global autotuning=disabled The worm blocks access to any domains that contain any of the following strings in their name: * ahnlab * arcabit * avast * avira * castlecops more... * ahnlab * arcabit * avast * avira * castlecops * centralcommand * clamav * comodo * computerassociates * cpsecure * defender * drweb * emsisoft * esafe * eset * etrust * ewido * fortinet * f-prot * f-secure * gdata * grisoft * hacksoft * hauri * ikarus * jotti * k7computing * kaspersky * malware * mcafee * microsoft * networkassociates * nod32 * norman * norton * panda * pctools * prevx * quickheal * rising * rootkit * securecomputing * sophos * spamhaus * spyware * sunbelt * symantec * threatexpert * trendmicro * virus * wilderssecurity * windowsupdate * nai. * ca. * avp. * avg. * vet. * bit9. * sans. under... If the current system date and time matches the condition the worm will attempt to download several files from the Internet. The worm runs only encrypted and properly signed files. The file is stored into the following folder: * %temp% If successful the following filename is used: * %variable%.tmp A string with variable content is used instead of %variable% . The worm may set the following Registry entries: * [HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServices SharedAccessParametersFirewallPolicyStandardProfile GloballyOpenPortsList] * "%port number%:TCP" = "%port number%:TCP:*:Enabled:%variable%" The performed data entry creates an exception in the Windows Firewall program.

udp://tracker.openbittorrent.com:80
udp://open.demonii.com:1337
udp://tracker.coppersurfer.tk:6969
udp://exodus.desync.com:6969

WhyAyeRy (2009-03-31)

What is this? A virus removal program?

VastLite (2009-04-01)

DING! DING! DING! correct sir, you win one internets (or lack-there-of, situation depending)

gimppuppy (2009-04-02)

so far this virus has been epic fail. the creator is probably crying him self to sleep in his mum's basement.
but thanks, this upload should help someone out there

 Lfc_4Ever (2009-04-12)

Where can i donate to TPB?

scorpion21 (2009-06-17)

THANK U VERY MUCH,,,
how about..W32/Sdbot.AEFV removal tool....?anyone?please