Microsoft warned users on Wednesday that a malicious Internet worm, dubbed Win32/Conficker. A, is making a wave of attacks exploiting a recent critical Windows security vulnerability. The worm has the potential to infect other computers across a network by exploiting security hole that Microsoft released a patch for in October.
Microsoft released an emergency patch last month repairing the error. However, if successfully exploited, the vulnerability could enable remote attackers to execute arbitrary code via a malicious file that would allow them to completely take control of a user's PC.
Researchers first detected attacks exploiting the vulnerability last week. Since then, the number of successful exploits grew to significant levels over the weekend. When they saw a significant increase in support calls, they noticed that the malware had "gained momentum" over the last two days,
In a posting on the Microsoft Malware Protection Center Blog, Microsoft said the malware mostly was spreading inside corporations, but had also hit many home PCs.
According to researchers at the SANS Institute, the worm in particular deletes any use-created System Restore points, and attempts to contact numerous sites, including those of Google, Yahoo, MSN and ask. com, to obtain the current date. Then the worm uses the date information to generate a list of domain names, which it further contacts in an attempt to download additional malicious files onto a user's affected computer.
Most of the infections are in US PCs, but there have been reports from Germany, Spain, France, Italy, Taiwan, Japan, Brazil, Turkey, China, Mexico, Canada, Argentina, and Chile. However, Microsoft noted that, for some reason, the worm avoids infecting Ukrainian computers.












