Windows worm builds a large Botnet

Diagram of Worm_DownAD.A behaviour from Trend Micro In October Microsoft issued MS08-067, a patch to close a critical hole in the RPC service. Since then the worm referred to as Worm:Win32/Conficker or Worm_DownAD.A has continued to spread rapidly, apparently because many users have not applied the patch. As a result a large new botnet has been established.

Analysts at Trend Micro estimate this botnet already comprises over 500,000 machines and what's really remarkable is that the botnet has grown to this size in the space of only three weeks.

The original attacks were targeted attacks aimed at corporations, but the infection has now spread to consumer machines. PCs all over the world are affected. Trend Micro say that the new botnet is not related to those disrupted by the shutdown of the McColo servers but is being spread by another group of cyber-criminals.

See also:

• Windows worm infection accelerates
• Even more RPC worms for Windows hole
• Windows RPC hole being exploited already
• Microsoft patches critical hole in its RPC service

(trk)