In October 2008, the world got its first taste of
the Conficker worm, the latest super computer
botnet infecting Windows-based PCs. Also known
as Downadup and Kido, hackers unleashed new
versions as recent as April 2009.
As many as 10 million computers could now be
infected.
What’s the Big Deal?
Other than slowing down your internet and
blocking you form visiting websites related to
computer security, what’s the big deal with this particular worm?
Conficker’s danger lies in its potential. The worm
essentially lies dormant on your system, awaiting
further instructions from its creators. In short,
authors of the botnet have the ability to control
infected computers and use infected networks to
carry out any number of dastardly missions.
Theories abound about the hacker’s plans, but the
most popular include using Conficker as a key-
logger, which tracks every keystroke you hit in
order to extract sensitive data, steal bank account
passwords and more.
Other theories have hackers using Conficker to
launch a massive spam attack that clogs up the
internet and brings many business and personal
activities to a screeching halt.
Experts buzzed about the worm’s re-launch on
April 1, 2009 because many believed that’s when the authors were going to send such instructions.
So far, though, instructions have not come. Instead, the authors have only attempted to push fake computer security software to a relatively small number of users.
|
|
 |
| |
|
| Although Conficker can be difficult to detect
on your PC, it presents several symptoms
that make it recognizable, including: |
| |
|
|
|
|
|
Staying Alive
It may not be clear what’s on the horizon for Conficker, but one thing is for certain: Conficker has a
remarkable ability to reproduce.
That’s because it exploits a vulnerability in the Windows Server Service to replicate. Once Conficker
infects one machine, it can easily spread throughout a network and infect other machines with the
same vulnerability.
Conficker spreads as a .dll file, a type of file that most software needs to execute functions. The .dll
is hidden and loads in the memory of the computer’s svchost.exe. While it does this, it changes
access conditions and removes the system’s permissions.
This means that as security utilities try to make the .dll visible in order to remove it, they fail
because these utilities no longer have access permissions.
That’s quite a catch 22.
But the creators of Tizer Secure™ have created a free utility that breaks Conficker’s unending loop.
|