Name :	Worm:W32/Downadup.AL
Detection Names :	Worm:W32/Downadup.AL Net-Worm.Win32.Kido
Aliases :	Worm:Win32/Conficker (Microsoft) Mal/Conficker (Sophos) W32/Conficker.worm.gen (Symantec)
Category:	Malware
Type:	Worm
Platform:	W32

A standalone malicious program which uses computer or network resources to make complete copies of itself. May include code or other malware to damage both the system and the network.

Removal Tools

F-Downadup
Specific tool with heuristics for Downadup worm variants:


FSMRT
Non-specific detection tool, larger file size:


Note: these are command line tools, please read the text file included in the ZIP for additional details.

Updates

These are beta tools. Use the following FTP location to determine the file dates:


Scanning Options

Downadup makes use of random extension names in order to avoid detection.

During disinfection scanning options should be set to:


Microsoft Help and Support

Knowledge Base Article 962007 provides numerous details for manual disinfection of Conficker.B (alias Downadup).

Upon execution, the Downadup (Kido, Conflicker) worm creates copies of itself in:


* Note: [Random] represents a randomly generated name.

Each file's timestamp is amended to match the timestamp of the %System%\kernel32.dll file. The worm then creates autorun entries in the registry, which ensure that a copy of the worm is executed at every system startup.

The worm may create the following files on removable and mapped drives:


See the description for Worm:W32/Downaduprun.A for additional details on the autorun.inf file.

And attach itself to the following processes:

The worm disables a number of system features, in order to facilitate its activities. It disables the following Windows services:

In addition to disabling these services, it checks to see whether it is running on a Windows Vista machine; if so, it also runs the following command to disable Windows Vista TCP/IP auto-tuning:

The worm also hooks the following API's in order to block access when the user attempts to access a long list of domains:

If the user attempts to access the following, primarily security-related domains, their access is blocked:
Propagation

To propagate itself, the worm first modifies the following registry entry so that it can spread more rapidly across a network:

The worm uses this driver to speed up its propagation capability, as it modifies the number of half-open connections to a 0x10000000(268435456) in memory, a function implemented in %System%\drivers\tcpip.sys.

It checks for a suitable computer around the network using NetServerEnum, then attempts to log on to any found computer with one of the following login credentials:

If the worm successfully accesses the network share, it will create a copy of itself to the "ADMIN$" share as the following: It then creates a scheduled daily job on the remote server, in order to execute the following command: The worm is also able to propagate by downloading a copy of itself onto other machines vulnerable to an exploit of the critical MS08-067 vulnerability. To do so, the worm first connects to the following sites to retrieve the system's %ExternalIPAddress%: Next, the worm creates a HTTP server on a random port:


Creating the HTTP server allows the malware to send out specially crafted packets (exploit code) from the infected machine to other machines. If the exploit is successful, the targeted machine is forced to download a copy of the malware from the first infected machine. 

The downloaded malware has one of the following extensions:


It then hooks NetpwPathCanonicalize API in order to avoid exploiting the vulnerability further.

Downloads

Downadup is capable of downloading files onto the infected system. First, the worm connects to one of the following domains to obtain the current system date: The obtained system date is used to generate a list of domains where the malware can download additional files.

It then verifies whether the current date is at least 1 January 2009. If so, it downloads and execute files from:


Note: %PredictableDomainsIPAddress% is the domain generated based on the system date.

The downloaded file has the format:


Registry

The worm deletes a number of keys from the registry, in order to deactivate the Security Center Notifications and prevent Windows Defender from starting. It also bypasses the Windows Firewall by creating the following registry entry, so that the system can download a copy of the worm:


To hide its presence in the system, the worm deletes any System Restore points created by the user, then modifies the following registry keys:


During infection, the worm may create a temporary (TMP) file in the the System or Temp folders. The TMP file created is registered as a service kernel driver using the following registry entry:


Once the key is created, the file %MalwarePath%\[random].tmp is deleted.

An interesting change the worm makes to the registry involves the following registry entries:
In these entries, %ServiceName% represents a two word combination taken from the following list: