What’s the sudden hype with Conficker?

The reason why this strain of the virus is so highly publicized in the news is because it was only recently discovered, and is also somewhat mysterious. The worm itself has already infected millions of machines on the Internet, but none of them are showing symptoms. This is because it isn’t supposed to “wake up” and start doing harm until April 1st.

The truth is, not much is known about what Conficker-C is supposed to to do its infected hosts once it awakens. Most speculate that it will give a remote attacker control of your computer to do harm. Most dangerously, the attacker can take control of your computer and many others all at once and use them to attack other computers. This is known as a botnet.

How do I know if I’m infected?

The easiest way to tell is to try to access one of these websites:

• http://www.symantec.com/norton/theme.jsp?themeid=conficker_worm&inid=us_ghp_link_conficker_worm
• http://www.microsoft.com/protect/computer/viruses/worms/conficker.mspx
• http://www.mcafee.com

If your computer is infected, the virus will actually prevent you from viewing the site. In that case, you need to immediately take steps to remove it.

Websites with removal instructions:

• Microsoft - http://support.microsoft.com/kb/962007
• Symantec - http://www.symantec.com/business/security_response/writeup.jsp?docid=2009-011316-0247-99

How to Prevent Infection

Infection can be easily prevented. First, ensure that Windows has the MS08-067 patch installed. It can be downloaded (both for XP and Vista) from Microsoft’s web site - http://www.microsoft.com/technet/security/Bulletin/MS08-067.mspx

Second, disable the autorun property. More instructions are available at http://www.us-cert.gov/cas/techalerts/TA09-020A.html

Third, it is reccomended that your computer have all of the latest software updates and your virus protection is up-to-date.

For More Help

More information regarding this virus is available from the US-CERT cyber alert database: http://www.us-cert.gov/cas/alerts/SA09-088A.html

If you require assistance with patching or removing the virus from your computer, please contact us or your computer administrator.