Microsoft Warns of Increasing Worm Outbreak

Microsoft has sent out warnings to its customers that a rise in attacks on a vulnerability in Windows could trigger a huge worm infestation on networks and the company is highly encouraging companies to apply the emergency patch released in October.

Microsoft says it has reports from users on a worm called Win32/Conficker.A, which infects other computers across a network by exploiting a vulnerability in the Windows Server service (SVCHOST.exe). If the vulnerability is successfully exploited, it could allow remote code execution when file sharing is enabled.

Recently weve received a string of reports from customers that have yet to apply the update and are infected by malware, Microsofts Bill Sisk wrote on the Microsoft Security Response Center blog. MS08-067 was an emergency patch released on Oct. 23, more than two weeks after Microsofts monthly patch cycle called Patch Tuesday.

Win32/Conficker.A Installation Method

This worm searches for the Windows executable 'services.exe' and will inject itself into it.
This worm copies itself to the Windows system folder as .dll where is a 5-8 character lowercase alphabetic name such as 'nxyme.dll'.

The worm adjusts the file time of the dropped DLL worm copy to the same as the system's kernel32.dll file time to mask forensic evidence of infection time. The registry is modified to execute the dropped DLL worm copy as a service.

Adds value: "DisplayName"
With data: "0"
To subkey: HKLM\SYSTEM\CurrentControlSet\Services\vcdrlxeu

Adds value: "ServiceDll"
With data: "\nxyme.dll"
To subkey: HKLM\SYSTEM\ControlSet001\Services\vcdrlxeu\Parameters

Once a machine has been infected the worm will patch the exploited function via a simple code hook in order to prevent re-infecting a machine it has already compromised. The worm opens and listens for connection attempts on a randomly chosen port between 1024 and 10000 and bypasses Windows firewall using APIs. The worm also stops the Internet connection sharing service.

Win32/Conficker.A Spreading Method

Win32/Conficker.A copies itself into memory and begins propagating to random IP addresses across a network by exploiting a vulnerability in the Windows Server service (SVCHOST.EXE). If the vulnerability is successfully exploited, the worm instructs the target computer to download a copy of the worm from the host computer via HTTP protocol using the random port opened by the worm.

The worm uses the following URLs to determine the computer's geographic location:

getmyip.org
getmyip.co.uk
checkip.dyndns.org

Win32/Conficker.A avoids infecting Ukrainian located computers.

Win32/Conficker.A Harm Caused
Creates HTTP Server
The worm opens a random port between 1024 and 10000 and acts like a web server (HTTP server). If the remote machine is exploited successfully, the victim will connect back to the http server and download a worm copy.

Resets System Restore Point
The worm may call an API function to reset the computer's system restore point, potentially defeating recovery using system restore.

Downloads Files
If the date is after November 25, 2008, this worm will build a URL in the following format and attempt to download a file from it:

/search?q=%d&aq=7

If the date is after December 1, 2008 Win32/Conficker.A will attempt to download a file 'loadadv.exe' from the domain 'trafficconverter.biz'.