Members
  • Total Members: 12816
  • Latest: t114563
Stats
  • Total Posts: 28524
  • Total Topics: 8240
  • Online Today: 815
  • Online Ever: 51419
  • (01. January 2010., 10:27:49)












Author Topic: Bitdefender Discovers New Conficker Variant (Win32.Worm.Downadup.Gen)  (Read 3504 times)

0 Members and 1 Guest are viewing this topic.

Amker

  • SCF Global Moderator
  • *****
  • Posts: 1081
  • KARMA: 22
  • Gender: Male
    • SCforum.info


The malware researchers from anti-virus vendor Bitdefender have identified a new variant of the infamous Conficker worm. Its analysis has revealed an improved obfuscation layer and additional blocked strings.

Conficker, also known as Downadup or Kido, is one of the most complex and well-written pieces of malware that security researchers have seen in recent years. The original variant, Conficker.A, appeared back in November 2008, soon after Microsoft broke its patch cycle in order to release MS08-067, a fix for the critical remote code execution vulnerability in the Services service that the worm exploits in order to spread.

December 2008 saw the release of Conficker.B, the most successful variant to date, which infected an estimated number of 12 million computers at its peak. This was followed by another seriously revamped version, initially dubbed Conficker.B++. Security experts speculated that this update aimed at combating the efforts of the Conficker Cabal, a coalition of industry organizations and companies collaborating to fight the worm. Conficker.B++ is currently better known as Conficker.C.

Bitdefender announced yesterday that it had identified a new variant, but details were scarce, as it was still being analyzed. New information will be posted when it becomes available, the company's press release reads. However, our inside sources at Bitdefender have been able to provide us with more insight into this incident.

New Conficker variant blocked by Bitdefender Antivirus

According to them, the analysts got suspicious after a customer reported that he could not access www.bdtools.net, the website used by Bitdefender to host free removal tools, from his computer infected with Conficker. This was particularly interesting, because the domain name was not amongst the ones blocked by the known variants of the worm. After securing a sample and analyzing it, the researchers concluded that they were dealing with a new version.

Even though it does not bring radical changes, like Conficker.B or Conficker.C do, this variation has an extended blacklist. The newly added strings, used by the worm to block access to domains or executables containing them, are: precisesecurity, ms-mvp, mitre, enigma, bdtools, av-sc, adware, activescan, stinger, kill, cfremo and bd_rem. Downadup also features two layers of obfuscation to prevent analysis and detection. However, our sources have informed us that, in this variant, the primary obfuscation layer is heavily modified and seems to have been particularly designed to block emulation.

Bitdefender has determined that this new version has actually been in circulation since around March 18th, but pretty much passed unobserved. It is currently detected as Win32.Worm.Downadup.Gen, under a generic routine able to identify any known variant of Conficker. The users who cannot access the www.bdtools.net website in order to obtain Bitdefender's free Conficker removal tool can download it from secure servers(http://www.softpedia.com/get/Antivirus/Win32-Worm-Downadup-Removal-Tool-SoftWin.shtml). Furthermore, people having trouble executing the tool on infected computers, should rename it to something random and try again.

sours: softpedia

# Online Anti-Malware Scanners: http://scforum.info/index.php/topic,734.0.html

Samker's Computer Forum - SCforum.info





 

With Quick-Reply you can write a post when viewing a topic without loading a new page. You can still use bulletin board code and smileys as you would in a normal post.

Name: Email:
Verification:
Type the letters shown in the picture
Listen to the letters / Request another image
Type the letters shown in the picture:
Second Anti-Bot trap, type or simply copy-paste below (only the red letters):www.scforum.info:

Enter your email address to receive daily email with 'SCforum.info - Samker's Computer Forum' newest content:

Terms of Use | Privacy Policy | Advertising