It has been over a month since we heard much about Conficker, but the worm has reappeared with a vengeance over the past seven days. According to Finnish security company F-Secure, more than one million PCs have been infected with the worm (also known as Kido or Downadup) in the past 24 hours, with a total of 3.52 million machines infected worldwide. According to F-Secure, that 3.52 million is a conservative estimate.

The problem isn't so much with the older version of Conficker (now known as Conficker.A) but with a new flavor, dubbed Conficker.B. Ars spoke with Roger Halbheer, Chief Security Advisor of Microsoft's EMEA (Europe, Middle East, and Africa); he's been monitoring (and writing) about the current spread of infections. The skyrocketing infection rate is actually being caused by several factors; Roger describes Conficker.B as a “beast,” and Microsoft has built the diagram above to demonstrate how the worm functions.

Once run or given access to an unprotected machine, Conficker.B begins searching for other systems or shares within the local network that it can infect. Shared systems, removable drives, or unpatched systems are all eligible targets, as are machines with weak passwords. This last bit is an important new feature of Conficker.B; a complete list of the passwords it checks for can be found here. If Conficker.B manages to successfully guess a password, it moves in and continues hunting for new targets. Microsoft summarizes the new strain as follows:

Worm:Win32/Conficker.B is a worm that infects other computers across a network by exploiting a vulnerability in the Windows Server service (SVCHOST.EXE). If the vulnerability is successfully exploited, it could allow remote code execution when file sharing is enabled. It may also spread via removable drives and weak administrator passwords. It disables several important system services and security products.

Roger confirmed that the Malicious Software Removal Tool (MSRT) has checked for and removed Conficker.B since December 29, 2008, but it's not possible to access any Microsoft website once Conficker.B has infected a system; the worm blocks access to multiple domains based on string identification. If you've got a system that's infected, you'll need to download the latest MSRT from Microsoft on a clean system and run it manually.

Not all AV scanners currently detect Conficker.B, even if they've been updated to detect Conficker.A—I don't have a list of specific solutions that can't currently catch the new worm, but all of Microsoft's antimalware/antivirus products—Forefront, OneCare (my personal favorite), and the Online Safety Scanner—will find Conficker.B if it's present (and you somehow haven't noticed). If there's a scrap of good news in all this, it's that Conficker.B is not a subtle worm.

Roger has provided some additional coverage on the worm that may be useful. First and foremost, he recommends installing MS08-067—this will not remove an existing infection, but it will guard against attack from either version of the agent, provided you aren't using weak passwords.

Source: ARS Technica: Conficker worm spikes, infects 1.1 million PCs in less than 24 hours