Conficker worm plays no tricks on April Fools' Day

Apr 02, 2009 by Glenn Chapman

The Conficker worm's April 1st trigger date came and went without the bedeviling computer virus causing any mischief but security specialists warn that the threat is far from over.

Conficker did just what the "white hats" tracking it expected -- the virus evolved to better resist extermination and make its masters tougher to find.

"There are still millions of personal computers out there that are, unknown to their owners, at risk of being controlled in the future by persons unknown," said Trend Micro threat researcher Paul Ferguson.

"The threat is still there. These guys are smart; they are not going to pull any obvious strings when there are so many eyeballs on the problem."

A task force assembled by Microsoft has been working to stamp out the worm, referred to as Conficker or DownAdUp, and the US software colossus has placed a bounty of 250,000 dollars on the heads of those responsible for the threat.

"It is pretty sophisticated and state-of-the-art," Ferguson said. "It definitely looks like the puppet masters are located in Eastern Europe."

The worm was programmed to evolve on Wednesday to become harder to stop. It began doing just that when infected machines got cues, some from websites with Greenwich Mean Time and others based on local clocks.

The evolved from East to West, beginning in the first time zones to greet April Fools' Day.

Conficker had been programmed to reach out to 250 websites daily to download commands from its masters, but on Wednesday it began generating daily lists of 50,000 websites and reaching randomly 500 of those.

The hackers behind the worm have yet to give the virus any specific orders. An estimated one to two million computers worldwide are infected with Conficker.

The worm, a self-replicating program, takes advantage of networks or computers that haven't kept up to date with security patches for Windows RPC Server Service.

It can infect machines from the Internet or by hiding on USB memory sticks carrying data from one computer to another.

Malware could be triggered to steal data or turn control of infected computers over to hackers amassing "zombie" machines into "botnet" armies.

"We're still watching to see what it's doing," said Ferguson, a member of the Conficker task force.

"A lot of us have our fingers crossed that people are getting rid of this."

Microsoft has modified its free Malicious Software Removal Tool to detect and remove Conficker. Security firms, including Trend Micro, Symantec and F-Secure, provide Conficker removal services at their websites.

The tell-tale signs that a computer is infected includes the worm blocking efforts to connect with websites of security firms providing online tools for removing the virus.

Conficker task force members have found a way to disable the block by typing in a few commands into computers.

The US Department of Homeland Security (DHS) released a tool on Monday to detect whether a computer is infected by Conficker.

The agency said the worm detector was developed by the US Computer Emergency Readiness Team (US-CERT).

"Our experts at US-CERT are working around the clock to increase our capabilities to address the cyber risk to our nation's critical networks and systems, both from this threat and all others," US-CERT director Mischel Kwon said when the tool was released.

US-CERT recommended that Windows users apply Microsoft security patch MS08-067 to help protect against the worm.

"Life goes on," Ferguson said as the sun set on April Fools' Day in California. "This system could still go off. Time will tell."

While Conficker has been in the spotlight, computer security specialists are finding 10,000 new samples of malicious software daily and hundreds of websites are spewing spam, some of it tainted with viruses, according to Ferguson.

"There are plenty of threats out there," he said.

(c) 2009 AFP

Explore further: Growing app industry has developers racing to keep up

add to favorites email to friend print save as pdf

Related Stories

Conficker worm digs in around the world

Apr 01, 2009

Computer security top guns around the world watched warily as the dreaded Conficker worm squirmed deeper into infected machines with the arrival of an April 1st trigger date.

Conficker Worm Prepares For A New Release On April 1

Mar 27, 2009

(PhysOrg.com) -- The conficker worm created havoc last year when it infected over 10 million computers on a global scale. The unique design of the conficker worm allowed for this large scale attack to over ...

Don't fret about Conficker: Here's what to do

Mar 31, 2009

(AP) -- The Conficker worm, a nasty computer infection that has poisoned millions of PCs, will start ramping up its efforts Wednesday to use those machines for cybercrimes. It's unclear whether everyday PC users will even ...

Help! How to avoid fast-moving computer worm

Jan 28, 2009

Since early January, a worm that has been referred to by several names, including "Downadup," "Kido" and "Conficker," has been infecting millions of computers around the world. The worm exploits a previously discovered vulnerability ...

Recommended for you

Growing app industry has developers racing to keep up

14 hours ago

Smartphone application developers say they are challenged by the glut of apps as well as the need to update their software to keep up with evolving phone technology, making creative pricing strategies essential to finding ...

Android gains in US, basic phones almost extinct

Apr 18, 2014

The Google Android platform grabbed the majority of mobile phones in the US market in early 2014, as consumers all but abandoned non-smartphone handsets, a survey showed Friday.

Hackathon team's GoogolPlex gives Siri extra powers

Apr 17, 2014

(Phys.org) —Four freshmen at the University of Pennsylvania have taken Apple's personal assistant Siri to behave as a graduate-level executive assistant which, when asked, is capable of adjusting the temperature ...

Microsoft CEO is driving data-culture mindset

Apr 16, 2014

(Phys.org) —Microsoft's future strategy: is all about leveraging data, from different sources, coming together using one cohesive Microsoft architecture. Microsoft CEO Satya Nadella on Tuesday, both in ...

User comments : 1

Adjust slider to filter visible comments by rank

Display comments: newest first

earls
not rated yet Apr 02, 2009
Yet another Y2K. Understandably, a lot of work went in behind the scenes, but the FUD spread by the media was absolutely unacceptable. Everyone knew about this absolutely horrific computer "virus" that was going to destroy the world, but actually knew absolutely nothing about it. Sensationalism to the end...

More news stories

TCS, Mitsubishi to create new Japan IT services firm

India's biggest outsourcing firm Tata Consultancy Services (TCS) and Japan's Mitsubishi Corp said Monday they are teaming up to create a Japanese software services provider with annual revenues of $600 million.

Finnish inventor rethinks design of the axe

(Phys.org) —Finnish inventor Heikki Kärnä is the man behind the Vipukirves Leveraxe, which is a precision tool for splitting firewood. He designed the tool to make the job easier and more efficient, with ...

Atom probe assisted dating of oldest piece of earth

(Phys.org) —It's a scientific axiom: big claims require extra-solid evidence. So there were skeptics in 2001 when University of Wisconsin-Madison geoscience professor John Valley dated an ancient crystal ...