Powered by Max Banner Ads 

We captured some logs from Conficker which illustrate what it does.

The first screen shows the Conficker C variant and its well documented update mechanism through DNS queries.

dns

Second screens shows some interesting P2P traffic, using the TCP protocol and the Kazaa network.

tcp

The IP sending those packets is located in China, registered under the “CNC Group Chongqing Province Network”.

The latest Conficker variant shows how well the Conficker infected nodes can communicate.

Jerome

Share and Enjoy:
  • Digg
  • Bumpzee
  • del.icio.us
  • Facebook
  • Furl
  • Mixx
  • NewsVine
  • Reddit
  • StumbleUpon
  • YahooMyWeb
  • Google Bookmarks

Related posts:

  1. Conficker Menace, Part IV – Is Conficker Just a Hype?  Powered by Max Banner Ads While the whole Silicon Valley...
  2. Conficker Alive and Well With New Variant Update via P2P  Powered by Max Banner Ads Researchers at Trend Micro have...
  3. Conficker Menace, Part III – Protection Against Conficker C  Powered by Max Banner Ads The impact of the Conficker...
  4. Conficker Menace Part I – What Is All the Hype About?  Powered by Max Banner Ads Conficker C virus was dismissed...
  5. Conficker / Downadup / Kido to Get Nastier on April 1st??  Powered by Max Banner Ads The Conficker worm, also known...

Related posts brought to you by Yet Another Related Posts Plugin.