Conficker.C - Worm Conficker

Conficker.C is the most recent variant of the Conficker worm. Exposure to Conficker.C is limited to systems that are still infected with the earlier variants, Conficker.A and Conficker.B, which operate by exploiting the MS08-067 vulnerability in Microsoft Windows Server Service. If the vulnerability is successfully exploited, it could allow remote code execution when file sharing is enabled. Conficker combats efforts at eradication by creating scheduled tasks and/or using autorun.inf files to reactivate itself.

McAfee has identified thousands of binaries that carry the Conficker payload. Depending on the specific variant, the worm may spread via LAN, WAN, web, or removable drives, and by exploiting weak passwords. Conficker disables several important system services and security products, and downloads arbitrary files.

Storm worm - Botnet Worm

Another big Trojan attack was Storm worm that hit computers worldwide in January 2007. The Storm worm originally posed as breaking news of bad weather hitting Europe. Over time, the worm was also seen in emails with the following subjects: personal greetings, reports that Saddam Hussein is still alive, reports that Fidel Castro is dead, sexy women, YouTube, and even blogs.

Users who fell for it unknowingly became a part of a botnet. A botnet serves as an army of commandeered computers, which are later used by attackers without their owners' knowledge.

Win32/Conficker.A - Worm Conficker

Win32/Conficker.A is a worm that spreads by exploiting a vulnerability in Server Service . The file is run-time compressed using UPX .

Installation
When executed, the worm copies itself in the %system% folder using the following name:
%variable%.dll
A string with variable content is used instead of %variable% .

The library %variable%.dll is loaded and injected into the following process:
services.exe

The worm registers itself as a system service using the following filename:
netsvcs

Win32/Conficker.AA - Worm

Win32/Conficker.AA is a worm that spreads via shared folders and on removable media. It connects to remote machines in attempt to exploit the Server Service vulnerability.
Installation
When executed, the worm copies itself in some of the the following locations:
- %system%\%variable%.dll
- %program files%\Internet Explorer\%variable%.dll
- %program files%\Movie Maker\%variable%.dll
- %appdata%\%variable%.dll
- %temp%\%variable%.dll
A string with variable content is used instead of %variable% .

The worm loads and injects the %variable%.dll library into the following processes:
- explorer.exe
- services.exe
- svchost.exe