Signature Detail

WORM: Conficker.C Activity

This signature detects traffic sent by the C variant of the Conficker/Downadup worm. The source address of the session may be infected with the worm and should be checked. Blocking using this signature has no effect in mitigating the spread of this worm. This signature can false positive on some Web browsers. To reduce the chance of false positives, it is recommended you apply this signature on outbound traffic going to the Internet and not on inbound traffic coming from the Internet.

References

• URL: http://www.microsoft.com/conficker
• URL: http://www.sophos.com/sophos/docs/eng/marketing_material/conficker-analysis.pdf