Heads up--potentially nasty little worm infestation to be aware of

Mar 31, 2009 18:04

On April 1, a new version of the worm/botnet Conficker (specifically Conficker.C) is supposed to deliver its "payload" (which includes downloads of instructions from upwards of 50,000 registered domains and measures to lock down the worm against attempts at detection and removal).

Conficker is one of the "new generation" of worms--set up by large spamming firms (often connected to the Russian mafia) to set up "botnets" which hijack remote PCs and use them both as spam-generators and to do "fast flux" hosting of spamvertised sites (often including pornography, fake Viagra, and whatnot).

Anyways, there are methods to fix this. :3

1) If you are using Windows, make sure you have the latest security patches, and make sure you can access Windows Update (Conficker.C blocks Windows Update, presumably to prevent download of a Windows patch issued October 2008 that blocks Conficker.C's main method of spread).

In particular, you want to make sure your computer has had the specific update (KB958644) that blocks Conficker.C's method of spread; you can go to Windows Update (or if you're a Vista user, launch it from the "Start" menu) and click "Review Your Update History". Make sure KB958644 is listed and/or you have had updates in March (it may not show the specific update because it was included in SP3 for WinXP and the latest Vista service pack).

If for whatever reason it's not listed, you can download it here (for XP, that is; other Windows-family updates here).

2) Use reliable antivirus and anti-spyware software. I personally recommend either Avast! or Avira Antivirus for home use (AVG is good but is becoming bloatware, and both Avast! and Avira have free home versions) and Sophos or Avast! for commercial use for antivirus; Spybot S&D and AdAware are still "best of breed" as far as spyware removers go IMHO, though I've heard a lot of good things about SpywareBlaster on legit security forums as well (not surprising--it uses the AdAware engine). I also like Malwarebytes Anti-Malware as a general scanner and removal tool--the free version is surprisingly powerful.

3) Turn off "Autorun" on your PC. Older versions of Conficker are known to use "Autorun" to copy themselves from infected thumb drives/SD cards/USB storage/CD-Rs and DVD-Rs to a PC. Here are some simple instructions on how to do this.

4) If you suspect you may be infected, use legit removal tools. The Internet Security Center has a list of known legit third-party removal tools; STICK WITH THE ONES ON THIS LIST.

I emphasize this last bit because a known producer of spyware/badware (Enigma Software) has been promoting a "Conficker Removal Tool"--and Enigma has a known history of not only involvement in badware but harassing sites writing about badware makers selling bogus "spyware removal" tools and involvement in spam-farms. There are likely other badware vendors also promoting bogus tools of this sort.
Previous post Next post
Up