Windows Worm Hits Millions

The Conficker worm, aka Downadup or Kido, has infected several million computers, according to researchers.

The Conficker worm, also known as Downadup, or Kido, was discovered back in October. Microsoft released a patch for it, but it’s still gone on to infect millions computers, possibly  as many as eight or nine million, the BBC reports. It spreads via low security networks, PCs that haven’t been updated, and even memory sticks.

Microsoft says the worm searches for a Windows executable file called "services.exe" and then becomes part of that code. From there, the worm copies itself into the Windows system folder, becoming a random dll file with a 5-8 character name. After that it modifies the Registry to run the infected dll file as a service.

When all that is accomplished, it creates an HTTP server, before resetting the computer’s System Restore point, then downloads files from the hacker’s web site.

Security company F-Secure says the worm uses a special algorithm to generate hundreds of different domain names every day, only one of which will actually be used for downloads.

Cleverly, F-Secure technicians have managed a reverse-engineering feat that lets them predict one of those possible domain names, which allows them to at least see how many computers are infected.

In a statement, F-Secure’s Toni Kovunen said:

"Right now, we’re seeing hundreds of thousands of unique IP addresses connecting to the domains we’ve registered."
"We can see them, but we can’t disinfect them – that would be seen as unauthorized use."

According to Microsoft, most of the infections have occurred in China, Brazil, Russia, and India. The company recommends installation of its MS08-067 patch and using good anti-virus software.