The DOWNAD / Conficker Worm

April 8 Update

TrendLabs has discovered a new Conficker variant (detected as WORM_DOWNAD.E). It appears that this may be the activity that was supposed to happen on April 1st. This new variant only affects those PCs that have been previously infected with WORM_DOWNAD.KK. If your Trend Micro products have been patched and you are running the latest engines and pattern files, you are protected from this variant.

Make sure you are not infected

If you made it to our website, you’re probably not infected since the worm blocks security vendor URLs. You may scan your PC using your Trend Micro product or HouseCall to see whether you are infected. If you discover that you are infected, find instructions for removal below:

* Consumers
* Small Business
* Medium Business, Enterprise


Prevent infection

* Immediately install patches/updates for MS08067 and other vulnerabilities as soon as vendors release these patches. Configure your PC to receive automatic updates and patches from Microsoft and software vendors.
* Make sure your security software is up to date.
* Disable the “Drive Auto-run” feature to avoid infections from USB drives.
* Employ secure passwords using a combination of letters, numbers and symbols and frequently change them.
* Take caution when searching online for DOWNAD and Conficker information. There are reports of rogue antivirus packages that are taking advantage of the situation. They will tell you that you are infected and ask you to pay money to download their application, which in many cases turns out to be malware.


Additional Information

* TrendLabs Malware Blog: DOWNAD/Conficker Watch: New Variant in the Mix?
* Trend Micro CounterMeasures blog: Restore Access to Blocked Sites on Conficked Systems
* Technical Details:
o WORM_DOWNAD.E
o WORM_DOWNAD.KK

Additionally, this threat is an example of the new breed of Web threats being developed by cybercriminals who use multiple techniques and protocols to infect and propagate their attacks. The Trend Micro Smart Protection Network blocks threats before they can enter your network and our correlated in-the-cloud web, email and file reputation databases allow us to quickly analyze and block new threats as they appear. Smart Protection Network powers many of our consumer, SMB and Enterprise solutions today. Learn more.


Trend Micro Recommends

For Home and Home Office Customers
Trend Micro Internet Security covers all your home computers with smart protection against viruses, spyware, and other malicious threats without slowing down your computer performance.

For Small Business Customers
Worry-Free™ Business Security Standard and Advanced is unique among key competitors in its ability to stop threats from the web before they can reach your business, protecting your business against data theft and risky websites.

For Medium Business and Enterprise Customers
The multiple protection layers embedded in Trend Micro™ OfficeScan™ stop this aggressive malware—protecting your endpoints against infection and preventing it from spreading to other PCs and servers.The faster protection delivered by the Trend Micro™ Smart Protection Network detects the initial infection and propagation attempts of Downad and blocks them immediately. Key security capabilities include:

* Web Reputation: prevents infected systems from communicating with their bot-master.

* Intrusion Defense Firewall: Downad worm exploits Microsoft vulnerability MS08-067. Trend Micro™ Intrusion Defense Firewall, a plug-in for OfficeScan 8, shields this vulnerability so you are fully protected.


Kaynak: The DOWNAD / Conficker Worm - Trend Micro USA

1 Nisanda güncellenecek diye beklerken 8 nisanda virüs kendisini yenilemiş ve internette gördüğüm kadarıyla ağı çökertebilecek güce gelmiş, bios'a yerleşiyor yani format atsanız bile geri gelecek. AntiVirüsleride silip kapatabiliyor. AntiVirüs ile ilgili sitelere girmeyi engelliyor mesela googlede Nod32 yazamayacaksınız. Yapan güzel yapmış (: