As I'm posting this, it's 00:18 on the 1st of April in Auckland, New Zealand.
New Zealand isn't particularly badly affected by Conficker.
But South Korea is in the TOP 5 infected countries. And it's already 20:18 on the 31st in Seoul right now.
So, when exactly is Conficker activating?
It goes like this:
- Once the local clock says it's April 1st, Conficker will check the date from the net
Conficker checks the local clock every 90 minutes (in some cases even more frequently)
The check is done with Windows GetSystemTime function
GetSystemTime ignores time zones, and always replies in GMT time (aka UTC time)
Because of this, machines around the world should report the same time
However, clock skew affects this as well
But not by much, as Windows machines will sync their local clock with time.windows.com once a week
Conficker's net time check uses several large websites. Sites such as:
- youtube.com
adobe.com
answers.com
baidu.com
bbc.co.uk
comcast.net
disney.go.com
ebay.co.uk
facebook.com
imdb.com
megapo*n.com
miniclip.com
rapidshare.com
torrentz.com
typepad.com
wikimedia.org
yahoo.com
http://www.f-secure.com/weblog/