April Fools' Day Computer Worm

There has been a lot of talk lately about the April Fools' Day worm known as Conficker.
The internet is buzzing with speculation about what this nasty bug may ultimately do.
The truth is - no one really knows. The one thing we do know that this worm is periodically calling out to the internet asking for instructions.
Until it gets those instructions on April 1st it is all speculation.

Could it erase your family photos from your computer? - Maybe.

Could it change your screensaver to read "Why did the chicken cross the road? Because Conficker made it?" - Who knows?

Could it create a zombie army of computers that will rise up against their human masters and constantly slam firewalls of financial institutions, effectively shutting down their networks and as a result crumble the world economy? - it's a good premise for a movie (I am calling Hollywood right now) Yet again - no one knows.

Me and an IT friend think you will get a popup that says "April Fools from Conficker!"

I am not trying to make light of the situation, but that is as good as possibility as anything else anyone will tell you.

Check out this 60 Minutes segment on Conficker and viruses

Geek Alert - technical content ahead - from Nik Brown at our sister property at TriCities.com

Why is Wednesday significant? It marks the day that currently infected computers will generate a list of 50,000 new domains a day that they could try. Of that group, the botnet (a network of computers under control of a remote hacker) will randomly select 500 for the machines to actually query. So far, Conficker-infected machines have been trying to connect each day to 250 Internet domains.

The virus authors need to get just one of those domains under their control to send their commands to the botnet. Once they have control of the Conficker botnet they can sell its services to spammers or use it to take down other internet sites or networks.

The worm exploits a previously patched vulnerability in the Windows Server service used by Windows 2000, Windows XP, Windows Vista, Windows Server 2003, Windows Server 2008, Windows 7 Beta, and Windows Server 2008 R2 Beta.

The worm only effects Microsoft Windows based computers. If you are running Apple OS X, Linux or a UNIX operating system your computer can not be infected.

Unlike other Internet threats that trick people into downloading a malicious program, Conficker is so good at spreading because it finds vulnerable PCs on its own and doesn’t need human involvement to infect a machine.

Once inside, it does nasty things. The worm tries to crack administrators’ passwords, disables security software, blocks access to antivirus vendors’ websites to prevent updating, and opens the machines to further infections by Conficker’s authors. Someone whose machine is infected might have to reinstall the operating system.

End geek alert

It is estimated that anywhere from 3 to 10 million computers are infected.
Why so many?
People aren't updating the security on your computer!
Also there are a lot of pirated copies of Windows in Europe and China.
Without a valid copy of Windows - you can't download the security updates which leaves you vulnerable.

Do you think you might be infected? A healthy dose of paranoia is never bad when you are dealing with viruses.
So what can you do?

These are instruction for people with a valid copy of Windows.
If you have a pirated copy - pay for Windows like the rest of us - arrggg!

Protect Yourself

1. Make sure automatic updates are on. Click Here to Learn how to do this in Vista, and here for automated updates on XP. If you are running Windows 98 or 2000 ... you need a new operating system. Microsoft does not support these anymore.

You can always update your Windows through their website also. http://www.windowsupdate.microsoft.com/

2. Make sure your Internet browser is updated. The latest version of Internet Explorer is IE8. I personally am not a fan of it, but make sure you have at least Internet Explorer 7. If you are not sure what version you have ... here is how to find out. With your internet browser open click on help and then about Internet Explorer. If you don't have at least IE7 - then upgrade. Click Here to upgrade to IE7

Mozilla Firefox is another great browser a lot of people are using. It also doesn't have some "vulnerabilities" that Internet Explorer has. When I say "vulnerabilities" I mean virus programmers are not writing viruses specifically for Firefox like they do for Internet Explorer. You can download Firefox free here.

3. Make sure you have virus protection. Most virus protection should stop Conficker. If you do have virus protection make sure it is up to date. It is always a good idea to make sure it is set to update automatically.

If you don't have virus protection software ... well you are asking for it.
There are some great free protection programs out there. I use Avast! on my personal computer. It is free and works well. You can download it here.

So far we have covered everything you should already be doing. Now let's talk about what you can do to get Conficker off your computer if you have it.

How do I know if I have Conficker?
1. If you cannot get into security websites and services, check your computer as soon as possible.
2. If you are unable to run Microsoft Windows Update, you may have the worm
3. If you are being locked out of a directory, then that is just one symptom.
4. If suddenly there are tasks created and scheduled on your computer, you may want to check if you already have a CF Worm running on it.
5. If you are being denied access to the admin account or password, this is a possible symptom of the Worm.

Download Microsoft's Malicious Software Removal Tool. It's free and can remove Conficker from your computer. Download Microsoft Malicious Software Removal Tool Here

More tools you may want to try to remove Conficker:
http://onecare.live.com/site/en-us/default.htm?s_cid=sah
http://www.bitdefender.com/VIRUS-1000462-en—Win32.Worm.Downadup.Gen.html
http://www.enigmasoftware.com/conficker_removal_tool_more_info.php
http://www.f-secure.com/v-descs/worm_w32_downadup_al.shtml
http://www.symantec.com/security_response/writeup.jsp?docid=2008-112203-2408-99&tabid=3

f-secure FAQ page on the Conficker worm:
http://www.f-secure.com/weblog/archives/00001636.html

Microsoft page on the Conficker worm:
http://www.microsoft.com/protect/computer/viruses/worms/conficker.mspx

Home users may also call Microsoft PC Safety hotline at 1-866-PCSAFETY, for assistance.