Conficker.C

Conficker.C Description

Conficker.C is a new variant of the Conficker worm and may be a greater threat than its predecessor. Conficker.C is expected to launch its attack on April 1st. The Conficker.C worm will disable the users' Windows Automatic Update, prevent the user access to the Windows Security Center, block DNS queries, delete all system restore points, as well as prevent the user access to security websites. The Conficker family of worms have been very dangerous and harmful to users' PC's. The new Conficker.C may prove to be even more damaging. It is essential at this point to keep all of your software updated in addition to verifying that your antivirus or antispyware applications are running with the latest definitions applied.

It is essential at this point to keep all of your software updated in addition to verifying that your antivirus or antispyware applications are running with the latest definitions applied.

Conficker.C is expected to contact various domains so it may obtain a set of instructions to carry out. Researchers have found the date of April 1st hard coded into Conficker.C as the date that these actions may take place. The domain generation algorithm has been slightly changed from previous versions of Conficker which makes Conficker.C much different. Below is a list of few of the domains that Conficker.C may contact on April 1st.

aaak.com.ai

aaax.com.hn

aaaxvt.co.ke

aabbb.com.uy

aabe.ac

aabfkx.com.co

aabk.lu

aacgebuee.ly

aach.dk

Aliases: W32/Conficker.FZ!worm.im [Fortinet], Trojan.Win32.Genome [Ikarus], Worm/Win32.Conficker [AhnLab-V3], Worm.Win32.Conficker.160578, Win32.Troj.Genome.160578, Trojan/Genome.bcmy, W32/Confick-F [Sophos], Heuristic.BehavesLike.Win32.Suspicious-PKR.G [McAfee-GW-Edition], Worm/Conficker.Z.17 [AntiVir], Trojan.Click1.38217 [DrWeb], Worm:W32/Downadup.BR [F-Secure], Trojan.Agent!+Z+N6pj2TLc, Trojan.Win32.Genome.moke [Kaspersky], Trojan.Win32.Kido.lxakz and Trojan/Conficker.ae.

Technical Information

File System Details

Conficker.C creates the following file(s):
# File Name Size MD5 Detection Count
1 %WINDIR%\system32\oeewos.dll 168,096 93d305c9094278e3e6da70e40b543c28 21
2 %WINDIR%\system32\pjjcxft.dll 103,904 ae7709bd2b77d2f40aa8f37c1126d8b1 12
3 %userprofile%\Application Data\sgrxa.dll 165,840 9c09418c738e265a27e6c599f43d86ab 11
4 %WINDIR%\system32\bmtvlitm.dll 161,612 393e2e61ff08a8f7439e3d2cfcb8056f 10
5 %WINDIR%\system32\dzzprkg.dll 154,652 67241ac88d798ccd90a6f49f481ac26c 9
6 %WINDIR%\system32\epfzqjg.dll 164,529 04199a5b981fd5a3d846d3f9d4c1d574 6
7 %PROGRAMFILES%\Internet Explorer\crnnxau.dll 166,440 76cfe416f735588146aaa3b4f8d0907a 5
8 %WINDIR%\system32\kauxeo.dll 171,362 d987a9af709bfd188071aa3f5e027aac 5
9 %WINDIR%\system32\dohtu.dll 161,750 d2eabe15257a453416efa18992d1edbd 4
10 %WINDIR%\system32\lmmtvk.dll 170,994 84ef65fbf6e58fc735e867031bbb8d02 4
11 %WINDIR%\system32\lccyr.dll 160,578 95ad430abca3da496600f764c120683c 4
12 %WINDIR%\system32\khgixdc.dll 174,488 b081022fc581decf4c8640dbc74a9198 3
13 %WINDIR%\system32\lvxan.dll 165,769 59fe65fad4849c95ed538475c1f707cf 3
14 %WINDIR%\system32\jyuzfa.dll 165,405 fb7ba7e14bafdc97724ffb66d39c2246 2
15 %WINDIR%\system32\njyqxzt.dll 161,461 023bc7137676d46c114483b11853131e 2
16 %WINDIR%\system32\gopws.dll 224,214 9645f61e0913a58a29ecfcce940136fe 1

Related Posts

Site Disclaimer

Enigmasoftware.com is not associated, affiliated, sponsored or owned by the malware creators or distributors mentioned on this article. This article should NOT be mistaken or confused in being associated in any way with the promotion or endorsement of malware. Our intent is to provide information that will educate computer users on how to detect, and ultimately remove, malware from their computer with the help of SpyHunter and/or manual removal instructions provided on this article.

This article is provided "as is" and to be used for educational information purposes only. By following any instructions on this article, you agree to be bound by the disclaimer. We make no guarantees that this article will help you completely remove the malware threats on your computer. Spyware changes regularly; therefore, it is difficult to fully clean an infected machine through manual means.

Leave a Reply

Please DO NOT use this comment system for support or billing questions. For SpyHunter technical support requests, please contact our technical support team directly by opening a customer support ticket via your SpyHunter. For billing issues, please refer to our "Billing Questions or Problems?" page. For general inquiries (complaints, legal, press, marketing, copyright), visit our "Inquiries and Feedback" page.