Trustwave Security Alert: Conficker Worm Variant C Expected to Attack on April 1, 2009

We are members of Trustwave. We just received this notice and thought the readers on USB Warm Gadgets would like to know, too....

from Trustwave

As you may have read in various news reports, a variant of the Conficker worm (a computer virus that has been propagating across the Internet) is expected to begin behaving more maliciously on April 1, 2009.


The first variant of the worm was identified in 2008. Once a computer was infected, the worm would contact one or more of 250 URLs to download malicious applications that, among other things, allowed attackers to take control of the infected system or steal confidential data. A number of organizations took action in early 2009 to bar those particular URLs. The new variant of the worm, Conficker C, increases the number of different URLs to 50,000. A review of the worm's code shows that Conficker C will begin contacting those URLs on April 1, 2009.

The worm spreads successfully via un-patched systems, weak passwords or by running automatically when removable media such as a USB drive is attached to a computer.

The best way to prevent infection or the repercussions of infection is to ensure that your systems' patches and anti-virus programs are up-to-date and to disable Windows' AutoRun feature. Visit Microsoft's Malware Protection Center entry about the Conficker worm at http://www.microsoft.com/security/portal/Entry.aspx?Name=Worm:Win32/Conficker.a and click on the Prevention tab for more information.

In addition, it's important to note how Trustwave solutions help protect against the worm:

• Trustwave's Network Access Control (NAC) solution denies network access to un-patched devices and bars access for devices that exhibit malware-like behavior


• Trustwave Unified Threat Management (UTM) service prevents in- and out-bound connections to unknown/illegitimate sources


• TrustKeeper® vulnerability scans discover vulnerabilities that may put network devices at risk


• TrustKeeper Agent monitors a system's security settings to ensure automatic updates are enabled and notifies administrators if they are disabled

For more information about Trustwave solutions, please visit our Web site at https://www.trustwave.com.

Trustwave periodically issues Security Alerts such as this one to inform customers about threats that may affect their efforts to protect sensitive information, secure their network environment and comply with industry standards and other regulations.