Tuesday, March 31, 2009

Scanners and utilities to detect Conficker worm

Conficker, also known as Downup, Downadup and Kido, is a computer worm that surfaced in October 2008 and targets the Microsoft Windows operating system. The worm exploits a previously patched vulnerability in the Windows Server service used by Windows 2000, Windows XP, Windows Vista, Windows Server 2003, Windows Server 2008, Windows 7 Beta, and Windows Server 2008 R2 Beta. The worm has been unusually difficult for network operators and law enforcement to counter because of its combined use of advanced malware techniques.

The worm exploits MS08-67 unpatched servers.

Here are some tools and utilities used to identify and to contain the Conficker worm


The domain names of different Conficker variants can be used to detect infected machines in a network. Inspired by the "downatool" from MHL and B. Enright, we have developed Downatool2. It can be used to generate domains for Downadup/Conficker.A, .B, and .C.

Memory Disinfector

It is hard to identify files containing Conficker because the executable are packed and encrypted. When Conficker runs in memory it is fully unpacked. The memory disinfector scans the memory of every running process in the system and terminates Conficker threads without touching the process it runs in. This helps to keep the system services running

Detecting Conficker Files and Registry

Network Scanner
Executable release
Python version

Removal tool(Nonficker Vaxination Tool)

The Conficker work vulnerability identification :
CVE : CVE-2008-4250
Missed Patch MS08-067
OVAL ID : oval:org.mitre.oval:def:6093
CWE: CWE-94 (Failure to Control Generation of Code (aka ’Code Injection’)




Coffee Maker said...

I wouldn't be totally surprised if the Conficker worm turned out to be an "April Fool's Joke," but of course doing nothing still isn't worth the risk

Nabil said...

Add source, or i'll be forced to report this abuse to Blogger Admins


Nabil said...

Thanks for adding source. We appreciate.
Feel free to use http://feeds2.feedburner.com/SecurityDatabaseToolsWatch as syndication to track new tools and software.