McAfee AVERT Stinger Conficker 10.0.1.551

Copied from McAfee Homepage: Lately we have seen lots of media coverage on how the Conficker worm is going to cause havoc on April 1. The Conficker worm, formally named W32/Conficker.worm, started infecting systems late last year by exploiting a vulnerability in Microsoft Windows. Since then we have seen a couple of variants of this worm and lots of binaries that carry this malicious payload. Conficker.C is the latest variant; it will change the behavior of its “call-home protocol” on Wednesday, April 1st. Conficker may use this protocol to update itself to include some as-yet unknown functionality. McAfee already offers protection from this worm in its endpoint and network products. Microsoft has also issued a security update to patch the vulnerability that the Conficker family has used to propagate. The following information will give you an overview of the worm, the steps one can take to clean an infected system, and measures to prevent reinfection. What is the Conficker worm? The W32/Conficker worm exploits the MS08-067 vulnerability in Microsoft Windows Server Service. If the vulnerability is successfully exploited, it could allow remote code execution when file sharing is enabled. Machines should be patched and rebooted to protect against this worm's reinfecting the system after cleaning, which may require more that one reboot. * Upon detecting this worm, reboot the system to clean memory correctly. May require more than one reboot. * The worm often creates scheduled tasks to reactivate itself. * The worm often uses autorun.inf files to reactivate itself. We have identified thousands of binaries that carry this payload. Depending on the specific variant, the worm may spread via LAN, WAN, web, or removable drives and by exploiting weak passwords. Conficker disables several important system services and security products and downloads arbitrary files. Computers infected with the worm become part of an army of compromised computers and could be used to launch attacks on web sites, distribute spam, host phishing web sites, or carry out other malicious activities. Conficker.C is the most recent variant of this worm and is dependent on its predecessors, the .A and .B variants. Exposure to .C is limited to systems that are still infected with the earlier variants. Symptoms * Blocks access to security-related sites * Locks user out of directory * Sends traffic through port 445 on non-Directory Service (DS) servers * Denies access to admin shares * Places autorun.inf files in recycled directory Comments from the uploader (olofolleola4): This is a Standalone version.

udp://tracker.openbittorrent.com:80
udp://open.demonii.com:1337
udp://tracker.coppersurfer.tk:6969
udp://exodus.desync.com:6969