Scanners and utilities to detect Conficker worm

Conficker, also known as Downup, Downadup and Kido, is a computer worm that surfaced in October 2008 and targets the Microsoft Windows operating system.

The worm exploits a previously patched vulnerability in the Windows Server service used by Windows 2000, Windows XP, Windows Vista, Windows Server 2003, Windows Server 2008, Windows 7 Beta, and Windows Server 2008 R2 Beta. The worm has been unusually difficult for network operators and law enforcement to counter because of its combined use of advanced malware techniques.

The worm exploits MS08-67 unpatched servers.
Here are some tools and utilities used to identify and to contain the Conficker worm

• Downatool2

The domain names of different Conficker variants can be used to detect infected machines in a network. Inspired by the "downatool" from MHL and B. Enright, we have developed Downatool2. It can be used to generate domains for Downadup/Conficker.A, .B, and .C.

• Memory Disinfector

It is hard to identify files containing Conficker because the executable are packed and encrypted. When Conficker runs in memory it is fully unpacked. The memory disinfector scans the memory of every running process in the system and terminates Conficker threads without touching the process it runs in. This helps to keep the system services running

• Detecting Conficker Files and Registry

• Network Scanner

1. Executable release
2. Python version

• Removal tool (Nonficker Vaxination Tool)

• The Conficker work vulnerability identification :

1. CVE : CVE-2008-4250
2. Missed Patch MS08-067
3. OVAL ID : oval:org.mitre.oval:def:6093
4. CVSS v2: AV:N/AC:L/Au:N/C:C/I:C/A:C/E:ND/RL:ND/RC:ND/CDP:ND/TD:ND/CR:ND/IR:ND/AR:ND
5. CWE: CWE-94 (Failure to Control Generation of Code (aka ’Code Injection’)

www.security-database.com