Network Scan for Conficker/Downadup Malware

Detecting Confickr (good analysis here at SRI site) infected hosts via an unauthenticated network scan:

• Original Honeynet Project post: "Detecting and Containing Conficker - Management Overview", more detailed post "Detecting Conficker", a full paper [PDF] and a tool link.
• Dan Kaminsky "Taming Conficker, The Easy Way" and, of course, the related Slashdot thread (yuck!).
• Also, Rich Mogul's "Easily Detect Conficker Infections- Over the Network."

It goes without saying, of course, that Qualys can detect it too now too!

BTW, this post also serves as a self-reminder that we here owe a few good people some beer :-)