W32/Conficker.worm Infection Cycle

The W32/Conficker.worm can infect systems via three infection vectors, via exploit MS08-067, an Autorun mechanism or by exploiting weak passwords. In addition the worm has an auto update routine to update previously infected systems .

These Infections are all multi stage processes. Involving the initial compromise,
copy files and then executing the malware.

Exploit Vector
Local network is scanned for susceptible computers. Once a susceptible computer is located the exploit is then attempted against the machine. If successful the process is hijacked and malware is copied from remote attacking machines HTTP server (random port # is used) to the localhost. At this point the machine is compromised.

Watch Out Potentially Unwanted Programs

Potentially Unwanted Programs (PUPs) is the generic term given to programs that find their way onto a machine, and that the user may or may not want to have. Although often deposited by way of Trojan horse, PUPs can be made by a legitimate corporate entity for some beneficial purpose.

A PUP is defined as ANY piece of code which a reasonably security-or privacy-minded computer user may want to be informed of, and, in some cases, remove. Even though they may be intended for legitimate corporate use, PUPs can alter the security state of the computer on which they are installed, and therefore most users will want to be aware of them.

The main types of PUPs are: