A new variant of the Conficker or sometimes referred to as Downadup, worm is about to start spreading like wildfire on April 1st. Win32\/Conficker.C is a worm capable of blocking security-related websites, terminating system security services, and downloading component files using time-based generated URLs.<\/p>\n
When the worm is executed, it drops a copy of itself using a random filename in the System directory on your system. It can also sometimes drop a copy in other locations under Program Files.<\/p>\n
It also automatically runs at startup, blocks access to any security-related websites, registers itself as a service, disables any antivirus\/security services, and more. It’s a nasty one to get rid of, but the payload that it carries is not that hurtful in terms of damage.<\/p>\n
On April 1st, the worm will attempt to access pre-computed domain names to either download an updated copy of itself or download other malware. This is what you have to watch out for with these types of worms because “other malware” could be anything and it could wreak havoc on your system.<\/p>\n
Security experts are urging users to update their anti-virus before April 1st and to make sure that their systems are clean. Below are a few ways to determine if you have the worm:<\/p>\n
Below are some services the worm disables, if any of these are disabled that you did not disable yourself – you could be infected:<\/p>\n
* wscsvc – Security Center
\n* WinDefend Windows Defender (available in Vista)
\n* wuauserv – Automatic Updates
\n* BITS – Background Intelligent Transfer Service
\n* ERSvc – Error Reporting Service
\n* WerSvc – Windows Error Reporting Service (available in Vista)<\/p>\n
The worm removes all system restore points. If you have no system restore points, you may be infected.<\/p>\n
Removal of Windows Security Center<\/p>\n
If the following registry entry is missing, you could be infected:<\/p>\n
HKLMSoftwareMicrosoftWindowsCurrentVersionexplorerShellServiceObjects{FD6905CE-952F-41F1-9A6F-135D9C6622CC}<\/p>\n