Conficker, back with a vengeance as top worm

Peter Dinham
Monday, 31 August 2009 10:23

Business IT - Security

The infamous Conficker worm first spread its malicious infection across the Internet more than eight years ago and just last month it shot back into prominence, infecting 43 percent of machines in use worldwide in the space of four weeks and, for good measure, it now installs rogue security software on compromised machines.

According to security firm BitDefender’s top 10 e-threats tracker list for August, once again worm-type malware dominated, with Win32.Worm.Downadup – a.k.a. Conficker or Kido – ranking first with 43 percent of the total amount of infected machines.

Conficker restricts access to the websites associated with IT security vendors and now, apparently, the latest variant of the worm can install rogue security software on compromised machines.

BitDefender’s report for August has Win32.Induc.A, a less common piece of malware application built with Borland (now Embarcadero) Delphi versions 4 through 7, in second place on its top-10 e-threats list. According to BitDefender, this virus does not infect binary files, but modifies the SYSCONST.PAS file, injects its malicious code and then compiles the file back.

The security firm says all the applications built with the compromised compiler would then be infected with the virus, and it warns that although Win32.Induc.A has no malicious payload, its abrupt escalation in its top 10 e-threats tracker suggests that, at present, “few Delphi developers are aware of the widespread infection.”

And, a file infector known as Win32.Sality.OG, grabs third spot on the list, with BitDefender reporting that the polymorphic file infector appends its encrypted code to executable files (.exe and .scr binaries), and in order to hide its presence on the infected machine it deploys a rootkit and attempts to kill antivirus applications installed locally.

Meanwhile,  BitDefender says that the increasing presence of the worm Worm.Autorun.VHG – now ranked fourth - reveals that users are still ignoring Microsoft’s security advisories to deploy security patches, with the Internet/network worm exploiting the Windows MS08-067 vulnerability in order to execute itself remotely using a specially crafted RPC (remote procedure call) package, an approach which the security firm says is also used by Conficker.
 
BitDefender also warns of a high-risk infection from its fifth ranked Win32.Virtob.Gen file infector written in assembly language, which it says hides its presence by injecting hooks into other Windows processes, but avoids compromising system files, and opens a backdoor that can be exploited by a remote attacker to seize control over the infected machine.