How to Scan for Conficker Worm

A bit of an update to the conficker worm that is supposedly scheduled for new updates and instructions today wednesday 1st. April 2009 and that nobody except for the bad guys knows what those instructions would be. Fyodor has rolled out a new nmap beta release to the nmap scripting engine that enables it to check if a particular machine is possibly infected by the conficker worm.

nmap -PN -T4 -p139,445 -n -v --script=smb-check-vulns --script-args safe=1 IP

A clean machine should report at the bottom: “Conficker: Likely CLEAN”, while likely infected machines say: “Conficker: Likely INFECTED”.

A useful feature to check your own network if any of your computer in the network is infected by the conficker worm.
Tenable security have also released a new Nessus plugin #36036

Posted in: botnets