nasty worm

[noswal]

Helsinki, Finland – January 7, 2009: F-Secure Corporation is issuing an alert about new versions of the "Downadup" worm. This worm infects Windows workstations and servers, causing various problems.

removal tool:
ftp://ftp.f-secure.com/anti-virus/tools/beta/f-downadup.zip

What does the worm do?

Downadup uses several different methods to spread. These include using the recently patched vulnerability in Windows Server Service, guessing network passwords and infecting USB sticks. As an end result, once the malware gains access to the inside of a corporate network, it can be unusually hard to eradicate fully.

Typical problems generated by the worm include locking network users out of their accounts. This happens because the worm tries to guess (or brute-force) network passwords, tripping the automatic lock-out of a user who has too many password failures.

Once this worm infects a machine, it protects itself very aggressively. It does this by setting itself to restart very early in the boot-up process of the computer and by setting Access Rights to the files and registry keys of the worm so that the user can't remove or change them.

The worm downloads modified versions of itself from a long list of websites. The names of these websites are generated by an algorithm based on current date and time. As there are hundreds of different domain names that could be used by the malware, it is hard for security companies to locate and shut them all down in time.

Further technical information about the malware is available on F-Secure's blog at http://www.f-secure.com/weblog/

 

[daveza]

Some more on this from Sky News -

A computer virus attacking Microsoft Windows has infected almost nine million machines and is spreading faster than ever before.

Experts say the worm has "skyrocketed" in recent days.
It is sweeping through thousands of offices in the UK and has affected computers at the Ministry of Defence.
The virus - known variously as Conficker, Kido or Downadup - burrows deep into the operating system and tricks the machine into running the infected program.
Once the worm is running on the computer it automatically starts to download more malicious programs from hackers' websites, with devastating effects.


The majority of computers infected by the worm, which was first identified in October, are in Russia, China, Brazil and India. But the virus is now taking hold in the UK.
The worm has password cracking capabilities, often successful because company passwords sometimes match a predefined password list that it carries.
Eddy Willems, a security analyst with anti-virus firm Kaspersky Labs, said that a new strain of the worm was now causing additional problems.

This virus is mainly affecting offices, who have not kept their software up to date.

Computer users are advised to ensure their anti-virus software, operating system and firewall is up to date, and that they have installed a Microsoft patch designed to combat the problem.
Experts have also warned the virus could spread by copying itself to USB memory sticks shared between computers, and urged users to use caution.

 

[gregmcc]

Patch patch patch and you will be fine.

 

[MeNeZ]

Anyone in SA been hit by it?

 

[Aphrael]

I just read about this on News24. I work for a very large company who I am quite sure keep their virus definitions up to date. But what concerns me is being the naive little end user at home. I tried looking for info on this worm on both Trendmicro and AVG's websites and found nothing. Maybe I need to start a different thread, but what is the best software to use??

 

[daveza]

Problem is that all anti-virus products will have different names for the viruses.

That said I can't find any reference at all on AVG or the AVG forum which is a bit concerning. Not even on their top threats page.

 

[gregmcc]

I know of a large company that was hit and was down for the day.

Even if your AV is 100% up to date - if you haven't patched you will still get infected. The worm uses a RPC exploit.