“By using the exploit from the Metasploit module as the code base, a virus/worm programmer only needs to implement functions for automatic downloading and spreading,” Chen wrote. Perhaps adding insult to injury, McAfee security researcher Xiao Chen, posting on the McAfee Avert Labs Blog, noted that the programmer used the Metasploit open source penetration testing framework as a code base. Additionally, the sneaky little worm removes all access rights of the user, except execute and directory usage, to protect its files. This makes it harder to remove because information about it is difficult to gather from an infected computer.

The worm executes automatically if the Autorun feature is enabled.Ĭertain TCP functions are also patched to block access to security-related Web sites by filtering every address that contains certain strings, BitDefender reported. It operates by copying itself in a random folder created inside the Recycler directory, BitDefender said, which is used by the Recycle Bin to store deleted files, and creating an autorun.inf file in the root folder. The latest variant of the worm now lets it spread via thumb drives, reported security software firm BitDefender. The vulnerability affects Microsoft Windows 2000, Windows XP, and Windows Server 2003. At least one-third of PCs that should be patched have not been. In addition, 8.9 million PCs have been infected, according to F-Secure. Now, security researchers believe the worm can spread via USB thumb drives. Microsoft issued a patch for the vulnerability, but a large number of PCs have remained unpatched. The, aka “Conficker” or “Kido,” first hit the world last year by exploiting the MS08-067 vulnerability that let it spread in loosely secured networks. A new method of propagation has given a computer worm a fresh lease on life.

Media autorun is enabled bitdefender