Conficker/Downadup news

[SysAdMini]

Worm Description
http://www.f-secure.com/v-descs/worm_w32_downadup_al.shtml
http://www.symantec.com/security_response/writeup.jsp?docid=2008-123015-3826-99&tabid=2

Removal Tools
ftp://ftp.f-secure.com/anti-virus/tools/beta/fsmrt.zip
ftp://ftp.f-secure.com/anti-virus/tools/beta/f-downadup.zip
http://www.symantec.com/content/en/us/global/removal_tool/threat_writeups/FixDownadup.exe
http://blogs.msdn.com/rockyh/archive/2009/01/14/conficker-removal-with-msrt.aspx
http://www.bitdefender.com/site/Downloads/downloadFile/1584/FreeRemovalTool

How Big is Downadup? Very Big.
http://www.f-secure.com/weblog/archives/00001579.html

Preemptive Downadup Domain Blocklist, Jan. 13-16
http://www.f-secure.com/weblog/archives/00001578.html

Downadup Blocklist, Jan. 9
http://www.f-secure.com/weblog/archives/00001577.html

[Tigger`]

Thanks for the info.

[Serg]

First enter was here http://blog.trendmicro.com/ms08-067-vulnerability-botnets-reloaded/.
Grown number infected computers here http://www.dshield.org/port.html?port=445

[SysAdMini]

Based on F-Secure's latest blocklist I have checked all domains. I haven't found any domains where
I could a payload from.

Here is a list of resolvable domains.

[SysAdMini]

if someone finds a sample of the Conficker worm please post it on site so i can get a sample soon as posible

Please don't post malware samples in public boards. You can contact me by PM for a sample.

[chopsforever]

Has anyone been able to determine whether or not the algorithm produces a finite number of domains?  Anyone seen any in-depth analysis?

[SysAdMini]

Calculating the Size of the Downadup Outbreak
http://www.f-secure.com/weblog/archives/00001584.html

Today's calculation is a total of 8,976,038 infections worldwide and 353,495 unique IP addresses.

[SysAdMini]

Preemptive Downadup Domain Blocklist, Jan. 13-16
http://www.f-secure.com/weblog/archives/downadup_domain_blocklist_17_31.txt

[SysAdMini]

The Mess that is WORM_DOWNAD
http://blog.trendmicro.com/the-mess-that-is-worm_downad/

[SysAdMini]

Some of the conficker domains mentioned in f-secure's latest blacklist

http://www.f-secure.com/weblog/archives/downadup_domain_blocklist_17_31.txt

resolve to the same ip addresses like latest Asprox domains.

Code: [Select]

fmhxqutvccr.org
fmkopswuzhj.biz
fnygfr.com
fuougcdv.org
fvwugekf.info
fwkbt.info
gbrpn.org
gbxpxugx.org
ghtileh.biz
gnyluuxneo.com

Asprox news

Latest Asprox domain at MDL

/EDIT

I am not the only one who discovered that.

http://www.matchent.com/wpress/?q=node/434

[SysAdMini]

Attempts at Smart Network Scanning
https://forums.symantec.com/t5/blogs/blogarticlepage/blog-id/malicious_code/article-id/233

Peer-to-Peer Payload Distribution
https://forums.symantec.com/t5/blogs/blogarticlepage/blog-id/malicious_code/article-id/227

Small Improvements Yield Big Returns
https://forums.symantec.com/t5/Malicious-Code/Downadup-Small-Improvements-Yield-Big-Returns/ba-p/381717#A230

A Lock with No Key
https://forums.symantec.com/t5/Malicious-Code/Downadup-A-Lock-with-No-Key/ba-p/381306#A229

Geo-location, Fingerprinting, and Piracy
https://forums.symantec.com/t5/Malicious-Code/Downadup-Geo-location-Fingerprinting-and-Piracy/ba-p/380993#A228

[SysAdMini]

Kidokiller - removal tool from Kaspersky
http://data2.kaspersky-labs.com:8080/special/KidoKiller.zip

[aaudi]

Additional description with screenshots

Conficker.B
http://www.ca.com/us/securityadvisor/virusinfo/virus.aspx?id=76852

Conficker.A
http://www.ca.com/securityadvisor/virusinfo/virus.aspx?id=75911

[SysAdMini]

Downadup.B/Conflicker.B IP generation and domain name predictor tool
http://mnin.blogspot.com/2009/01/downatool-for-downadupbconflickerb.html

You can use it to predict the list of domain names that the worm will contact on a given date. Downadup.B uses a completely different algorithm for selecting IPs to attack with MS08-067. Fortunately, you can also use this tool to mimic the random IP address generation algorithm to predict which IPs the worm will attempt to attack.

Memory Injection Model
http://blog.threatexpert.com/2009/01/confickerdownadup-memory-injection.html

[SysAdMini]

F-Secures' Preemptive Downadup Blocklist for February
http://www.f-secure.com/weblog/archives/00001593.html