Conficker

Conficker, also known as Downadup or Kido, is a family of Windows computer worms first identified in 2008. It spread rapidly across networks and the Internet, infecting millions of computers running various editions of Microsoft Windows. The worm was notable for its multi-pronged propagation, its use of a domain generation algorithm to locate updates, and its ability to resist takedown efforts.

Propagation and infection: Conficker exploited the MS08-067 vulnerability in the Windows Server service to execute code on unpatched systems. It also tried to brute-force weak administrator passwords on shared network resources and to propagate via removable drives and network shares. Once on a system, it would install a backdoor, disable security services such as Windows Update and Security Center, and attempt to block access to security websites.

Variants: The Conficker family includes several variants, commonly referred to as A, B, and C. Conficker.C (also called Downadup.C) introduced a domain-generation algorithm that generated a large number of domain names daily to use as command-and-control servers, complicating takedown efforts. Later variants added more persistence, stealth, and anti-virtual-machine features.

Impact and remediation: At its peak, Conficker infected millions of machines worldwide, prompting coordinated responses from researchers, antivirus companies, and government agencies. Microsoft issued MS08-067 as the patch to fix the underlying vulnerability, and security firms released removal tools and guidance. Defenses include applying the MS08-067 patch, disabling Autorun where appropriate, enforcing strong passwords, segmenting networks, and scanning for and removing infected computers. Ongoing monitoring helped disrupt some of its command-and-control infrastructure and reduce reinfection risk.