Win32/Conficker is a worm that infects other computers across a network by exploiting a vulnerability in the Windows Server service (SVCHOST.EXE). If the vulnerability is successfully exploited, it could allow remote code execution when file sharing is enabled. Depending on the specific variant, it may also spread via removable drives and by exploiting weak passwords. It disables several important system services and security products and downloads arbitrary files.

 

W32/Conficker is also known as:

 

TA08-297A (other)

CVE-2008-4250 (other)

VU827267 (other)

Win32/Conficker.A (CA)

Mal/Conficker-A (Sophos)

Trojan.Win32.Agent.bccs (Kaspersky)

W32.Downadup.B (Symantec)

Trojan-Downloader.Win32.Agent.aqfw (Kaspersky)

W32/Conficker.worm (McAfee)

Trojan:Win32/Conficker!corrupt (Microsoft)

W32.Downadup (Symantec)

Confickr (other)

Microsoft strongly recommends that users apply the update referred to in Security Bulletin MS08-067 immediately.

 

Microsoft also recommends that users ensure that their network passwords are strong to prevent this worm from spreading via weak administrator passwords. More information is available here.