Summary
Worm:W32/Conficker.AL is a variant of Worm:W32/Downadup that can spread using three different methods and is capable of hiding its actions on the infected machine, as well as downloading files from remote sites.
Removal
Based on the settings of your F-Secure security product, it will either move the file to the quarantine where it cannot spread or cause harm, or remove it.
Note
Downadup makes use of random extension names in order to avoid detection. During disinfection, Scanning Options should be set to:
- Scan all files
A False Positive is when a file is incorrectly detected as harmful, usually because its code or behavior resembles known harmful programs. A False Positive will usually be fixed in a subsequent database update without any action needed on your part. If you wish, you may also:
- Check for the latest database updatesFirst, check if your F-Secure security program is using the latest updates, then try scanning the file again.
- Submit a sampleAfter checking, if you still believe the file is incorrectly detected, you can submit a sample of it for re-analysis.Note: If the file was moved to quarantine, you need to collect the file from quarantine before you can submit it.
- Exclude a file from further scanningIf you are certain that the file is safe and want to continue using it, you can exclude it from further scanning by the F-Secure security product.Note: You need administrative rights to change the settings.
Technical Details
Worm:W32/Conficker.AL is a variant of Worm:W32/Downadup.A which is able to spread copies of itself over a network using three different methods: file sharing, exploitation of a vulnerability and exploitation of Windows Autorun.
In addition to attempting to connect to remote sites, Conficker.AL uses stealth techniques to hide its actions, and makes a number of changes to the Windows Registry.
More technical information is also available in the related descriptions:
Installation
Upon execution, Downadup creates copies of itself in:
- %System%\[Random].dll
- %Program Files%\Internet Explorer\[Random].dll
- %Program Files%\Movie Maker\[Random].dll
- %All Users Application Data%\[Random].dll
- %Temp%\[Random].dll
- %System%\[Random].tmp
- %Temp%\[Random].tmp
Note: [Random] represents a randomly generated name.
Each file's timestamp is amended to match the timestamp of the %System%\kernel32.dll file. The worm then creates autorun entries in the registry, which ensure that a copy of the worm is executed at every system startup.
The worm then attach itself to the following processes:
- svchost.exe
- explorer.exe
- services.exe
Activity
The worm disables a number of system features, in order to facilitate its activities. It disables the following Windows services:
- Windows Automatic Update Service (wuauserv)
- Background Intelligent Transfer Service (BITS)
- Windows Security Center Service (wscsvc)
- Windows Defender Service (WinDefend)
- Windows Error Reporting Service (ERSvc)
- Windows Error Reporting Service (WerSvc)
In addition to disabling these services, it checks to see whether it is running on a Windows Vista machine; if so, it also runs the following command to disable Windows Vista TCP/IP auto-tuning:
- netsh interface tcp set global autotuning=disabled
The worm also hooks the following API's in order to block access when the user attempts to access a long list of domains:
- DNS_Query_A
- DNS_Query_UTF8
- DNS_Query_W
- Query_Main
- sendto
If the user attempts to access the following, primarily security-related domains, their access is blocked:
- virus
- spyware
- malware
- rootkit
- defender
- microsoft
- symantec
- norton
- mcafee
- trendmicro
- sophos
- panda
- etrust
- networkassociates
- computerassociates
- f-secure
- kaspersky
- jotti
- f-prot
- nod32
- eset
- grisoft
- drweb
- centralcommand
- ahnlab
- esafe
- avast
- avira
- quickheal
- comodo
- clamav
- ewido
- fortinet
- gdata
- hacksoft
- hauri
- ikarus
- k7computing
- norman
- pctools
- prevx
- rising
- securecomputing
- sunbelt
- emsisoft
- arcabit
- cpsecure
- spamhaus
- castlecops
- threatexpert
- wilderssecurity
- windowsupdate
- nai
- ca
- avp
- avg
- vet
- bit9
- sans
- cert
Propagation (File Sharing)
To propagate itself, the worm first modifies the following registry entry so that it can spread more rapidly across a network:
- HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters"TcpNumConnections" = dword:0x00FFFFFE
The worm uses this driver to speed up its propagation capability, as it modifies the number of half-open connections to a 0x10000000(268435456) in memory, a function implemented in %System%\drivers\tcpip.sys.
It checks for a suitable computer around the network using NetServerEnum, then attempts to log on to any found computer with one of the following login credentials:
- Using the existing credentials of the infected user account; if this account does not have admin privileges on the target machine, this operation will not succeed.
- Acquiring the list of usernames from the targeted computer using NetUserEnum API, then attempting to log on to the targeted computer using the existing user accounts and one of the following passwords:
- [username]
- [username][username]
- [reverse_of_username]
- 00000
- 0000000
- 00000000
- 0987654321
- 11111
- 111111
- 1111111
- 11111111
- 123123
- 12321
- 123321
- 12345
- 123456
- 1234567
- 12345678
- 123456789
- 1234567890
- 1234abcd
- 1234qwer
- 123abc
- 123asd
- 123qwe
- 1q2w3e
- 22222
- 222222
- 2222222
- 22222222
- 33333
- 333333
- 3333333
- 33333333
- 44444
- 444444
- 4444444
- 44444444
- 54321
- 55555
- 555555
- 5555555
- 55555555
- 654321
- 66666
- 666666
- 6666666
- 66666666
- 7654321
- 77777
- 777777
- 7777777
- 77777777
- 87654321
- 88888
- 888888
- 8888888
- 88888888
- 987654321
- 99999
- 999999
- 9999999
- 99999999
- a1b2c3
- aaaaa
- abc123
- academia
- access
- account
- Admin
- admin
- admin1
- admin12
- admin123
- adminadmin
- administrator
- anything
- asddsa
- asdfgh
- asdsa
- asdzxc
- backup
- boss123
- business
- campus
- changeme
- cluster
- codename
- codeword
- coffee
- computer
- controller
- cookie
- customer
- database
- default
- desktop
- domain
- example
- exchange
- explorer
- files
- foobar
- foofoo
- forever
- freedom
- games
- home123
- ihavenopass
- Internet
- internet
- intranet
- killer
- letitbe
- letmein
- Login
- login
- lotus
- love123
- manager
- market
- money
- monitor
- mypass
- mypassword
- mypc123
- nimda
- nobody
- nopass
- nopassword
- nothing
- office
- oracle
- owner
- pass1
- pass12
- pass123
- passwd
- Password
- password
- password1
- password12
- password123
- private
- public
- pw123
- q1w2e3
- qazwsx
- qazwsxedc
- qqqqq
- qwe123
- qweasd
- qweasdzxc
- qweewq
- qwerty
- qwewq
- root123
- rootroot
- sample
- secret
- secure
- security
- server
- shadow
- share
- student
- super
- superuser
- supervisor
- system
- temp123
- temporary
- temptemp
- test123
- testtest
- unknown
- windows
- work123
- xxxxx
- zxccxz
- zxcvb
- zxcvbn
- zxcxz
- zzzzz
If the worm successfully accesses the network share, it will create a copy of itself to the "ADMIN$" share as the following:
- \\[Server Host Name]\ADMIN$\System32\[random filename].[random extension]
It then creates a scheduled daily job on the remote server, in order to execute the following command:
- rundll32.exe [random filename].[random extension], [random]
Propagation (Autorun)
The worm may create the following files on removable and mapped drives:
- %DriveLetter%\RECYCLER\S-%d-%d-%d-%d%d%d-%d%d%d-%d%d%d-%d\[...].[3 random characters]
- %DriveLetter%\autorun.inf
The autorun file is used as another vector for distributing copies of the worm; see the description for Worm:W32/Downaduprun.A for additional details.
Propagation (Vulnerability)
The worm is also able to propagate by downloading a copy of itself onto other machines vulnerable to an exploit of the critical MS08-067 vulnerability. To do so, the worm first connects to the following sites to retrieve the system's %ExternalIPAddress%:
- https://checkip.dyndns.org
- https://getmyip.co.uk
- https://www.getmyip.org
- https://www.whatsmyipaddress.com
Next, the worm creates a HTTP server on a random port:
- https://%ExternalIPAddress%:%RandomPort%
Creating the HTTP server allows the malware to send out specially crafted packets (exploit code) from the infected machine to other machines. If the exploit is successful, the targeted machine is forced to download a copy of the malware from the first infected machine.
The downloaded malware has one of the following extensions:
- bmp
- gif
- jpeg
- png
It then hooks NetpwPathCanonicalize API in order to avoid exploiting the vulnerability further.
Downloads
Downadup is capable of downloading files onto the infected system. First, the worm connects to one of the following domains to obtain the current system date:
- ask.com
- baidu.com
- google.com
- w3.org
- yahoo.com
The obtained system date is used to generate a list of domains where the malware can download additional files.
It then verifies whether the current date is at least 1 January 2009. If so, it downloads and execute files from:
- https://%PredictableDomainsIPAddress%/search?q=%d
Note: %PredictableDomainsIPAddress% is the domain generated based on the system date.
The downloaded file has the format:
- [random].tmp
Registry Changes
The worm deletes a number of keys from the registry, in order to deactivate the Security Center Notifications and prevent Windows Defender from starting. It also bypasses the Windows Firewall by creating the following registry entry, so that the system can download a copy of the worm:
- HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List, [PortNumber]:TCP = "[PortNumber]:TCP:*Enabled:[random]"
Stealth
To hide its presence in the system, the worm deletes any System Restore points created by the user, then modifies the following registry keys:
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\Advanced\Folder\Hidden\SHO WALLCheckedValue = dword:00000000
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost, netsvcs = %Previous data% and %Random%
During infection, the worm may create a temporary (TMP) file in the the System or Temp folders. The TMP file created is registered as a service kernel driver using the following registry entry:
- HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\[random]Type = dword:00000001Start = dword:00000003ErrorControl = dword:00000000ImagePath = "\...\%MalwarePath%\[random].tmp"DisplayName = [Random]
Once the key is created, the file %MalwarePath%\[random].tmp is deleted.
An interesting change the worm makes to the registry involves the following registry entries:
- HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ DisplayName = %ServiceName% Type = dword:00000020 Start = dword:00000002 ErrorControl = dword:00000000 ImagePath = "%SystemRoot%\system32\svchost.exe -k netsvcs" ObjectName = "LocalSystem" Description = %description%
- HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\[random]\ParametersServiceDll = %MalwarePath%
In these entries, %ServiceName% represents a two word combination taken from the following list:
- Boot
- Center
- Config
- Driver
- Helper
- Image
- Installer
- Manager
- Microsoft
- Monitor
- Network
- Security
- Server
- Shell
- Support
- System
- Task
- Time
- Universal
- Update
- Windows
Protect your devices from malware with F‑Secure Total
Protecting your devices from malicious software is essential for maintaining online security. F‑Secure Total makes this easy, helping you to secure your devices in a brilliantly simple way.
- Award‑winning antivirus and malware protection
- Online browsing, banking, and shopping protection
- 24/7 online identity and data breach monitoring
- Unlimited VPN service to safeguard your privacy
- Password manager with private data protection
Choose how many devices you want to protect to get started.
- Free customer support
- Cancel anytime
- The trial does not obligate you to buy the product
After 30 days your subscription will renew automatically for one year at €69.99.
)
)
More Support
Community
Ask questions in our Community.
User guides
Check the user guide for instructions.
Contact Support
Chat with with or call an agent.
Submit a Sample
Submit a file or URL for analysis.