Microsoft warns of worm exploiting Windows flaw
Published: 27 Nov 2008 08:53 GMT
A worm dubbed Win32/Conficker.A is making the rounds of Windows machines, exploiting a security hole that Microsoft released a patch for in October, the software maker said on Wednesday.
The number of attacks have increased over the past couple of days, exploiting a critical vulnerability that was addressed by security update MS08-067.
The malware has mostly been spreading inside corporations, but has also hit several hundred home PCs, Microsoft said in a posting on the Microsoft Malware Protection Center blog.
"It opens a random port between port 1024 and 10000, and acts like a web server. It propagates to random computers on the network by exploiting MS08-067. Once the remote computer is exploited, that computer will download a copy of the worm via HTTP using the random port opened by the worm. The worm often uses a .jpg extension when copied over and then it is saved to the local system folder as a random named dll," the posting states.
"It is also interesting to note that the worm patches the vulnerable API in memory so the machine will not be vulnerable anymore. It is not that the malware authors care so much about the computer as they want to make sure that other malware will not take it over too," Microsoft said.
Most of the infections are in US PCs, but there have also been reports from Germany, Spain, France, Italy, Taiwan, Japan, Brazil, Turkey, China, Mexico, Canada, Argentina and Chile. The worm avoids infecting Ukrainian computers for some reason, Microsoft said.
Several bots, under the generic name Backdoor:Win32/IRCbot.BH, also are exploiting the security hole. They drop a backdoor Trojan that connects to an IRC server to receive commands.
Credit: Internet worm exploits Windows vulnerability from CNET News.com
Did you find this article useful?
11 out of 11 people found this useful
Digg
Slashdot
Del.ici.ous
Stumble
Reddit
Full Talkback thread
1 comment
