Would You Still Love Me If I Were a Worm? A Conficker Story

Somewhere out there is a USB drive that's been carrying a loaded weapon since the Bush administration. This week, someone plugged it into a machine we defend, and 18 years of patience ended in seconds.

This is not an active-compromise story. Nothing executed. Nothing moved laterally. But it is a useful one, because it's a clean illustration of why "old" malware doesn't mean "harmless" malware. Old just means malware that's been sitting somewhere, waiting for someone to make a mistake.

The File That Gave Itself Away

CrowdStrike Falcon's on-sensor ML engine flagged a file on workstation with the highest confidence rating the sensor issues and a High severity score, the kind of combination that usually means automated triage caught something real.

Here's the file path:

D:\RECYCLER\S-5-3-42-2819952290-8240758988-879315005-3665\jwgkvsq.vmx

That path tells most of the story before a single external lookup.

\RECYCLER\ is a legacy, pre-Vista recycle bin folder, rarely used today, which is exactly why it remains a favored hiding spot. The subfolder underneath is dressed up to resemble a Windows security identifier, except it isn't a valid one: real SIDs begin with S-1-, not S-5-, which points to a worm generating a decoy and getting the format slightly wrong.

The filename is seven random lowercase characters, a naming convention this family has used for close to two decades, and the .vmx extension is doing its best impression of a VMware config file despite having nothing to do with VMware. None of it serves a function. It's all disguise.

One more detail closed the loop: the file was located on D:\, a secondary drive rather than the system volume, historically consistent with removable media.

An analyst who has worked this family before doesn't need a lookup to know what they're looking at. Ours didn't. A VirusTotal check on the hash confirmed the read regardless: 66 of 70 vendors landed on the same verdict. Conficker, also tracked as Downadup or Kido.

Meet the Worm

Conficker first surfaced in 2008, exploiting an unpatched Windows Server Service vulnerability to spread rapidly across networks. By 2009, estimates put infected machines in the millions, spanning home PCs, corporate networks, and even hospital and government systems. It spread three ways: exploiting the unpatched SMB vulnerability directly, brute-forcing weak network share credentials, and, most relevant here, copying itself onto USB drives with an autorun dropper so it would execute automatically on the next machine that drive touched.

For context on the timeline: this file's family is 18 years old, old enough to legally drink in most countries, and, at least by the calendar, currently waiting on a dorm roommate assignment.

Microsoft's patch shipped within weeks of disclosure, and modern Windows builds have disabled USB autorun by default for years. Against a properly patched, modern host, Conficker's original spread mechanism no longer functions the way it used to. But AV and EDR engines still catch it easily, because detection keys off static characteristics: the hash, the naming convention, the disguised file path. The file doesn't have to be current to still be recognizable. It just has to be sitting on a drive somewhere, waiting to get plugged into the wrong machine.

What Actually Happened

Falcon quarantined the file on detection. There was no process execution, no lateral movement, and no propagation. The worm never had the opportunity to act, going from on-disk to contained before it could become a problem.

That containment speed is really the point. A team encountering Conficker for the first time might spend an hour just confirming what the file is. Ours didn't need that step, because the analysts on the case had already worked this exact family before. That recognition is the RADICL value add. Buying a sensor is straightforward, but having someone on the other end who's already fought this specific adversary is the part that can't simply be licensed.

The counterfactual is worth sitting with, too. Drop that same drive into an unpatched, unmonitored machine with autorun still enabled and flat network shares behind it, and 2026 looks a lot like 2009: it spreads. What changed isn't the file, it's everything around it: a modern OS with autorun disabled, and a sensor that caught it the moment it touched disk.

The Takeaway

Most small and mid-sized organizations would never have seen this at all. No sensor, no analyst reviewing the alert, and an old worm gets a quiet foothold that goes unnoticed for months. Dwell time is the whole game, and it starts the moment the drive goes in.

Detection and expertise aren't the same product. Tooling flagged the file correctly on its own. Analysts who already recognized the adversary closed it out in minutes with zero disruption to the business. That combination is what a managed vSOC actually provides.

Don't plug in the USB. Not the one found in a parking lot, not the one handed out at a conference, not the unlabeled one sitting in a supply drawer.

You don't know where it's been or what it's carrying, and neither does the person who handed it to you. Old media is unknown media until it's been scanned. If something feels off, that's precisely what a vSOC is for. Send it our way and we'll run it down.

Case detail: Conficker/Downadup worm file (jwgkvsq.vmx) detected at rest on a client endpoint, High severity, 100% confidence, VirusTotal consensus 66/70. Quarantined on detection with no execution or spread observed. Verdict: true positive, non-propagating.