[SpySentinel]

On April 1, the conficker worm will be released, and no one knows what will happen or who will be infected.


What is Conficker

Conficker is a computer worm that targets the Microsoft Windows operating system. The worm exploits a previously patched vulnerability in the Windows Server service used by Windows 2000, Windows XP, Windows Vista, Windows Server 2003, Windows Server 2008, Windows 7 Beta, and Windows Server 2008 R2 Beta.

If you are infected with the Win32/Conficker.B worm, you may experience the following symptoms:

• Account lockout policies are being tripped.
  
• Automatic Updates, Background Intelligent Transfer Service (BITS), Windows Defender, and Error Reporting Services are disabled.
  
• Domain controllers respond slowly to client requests.
  
• The network is congested.
  
• Various security-related Web sites cannot be accessed.

It uses the following techniques to exploit computers:

• Exploitation of the vulnerability that is patched by security update 958644 (MS08-067)
  
• The use of network shares
  
• The use of AutoPlay functionality

To learn more about how Conficker affects your computer, please visit the Microsoft Help and Support Site



How does Conficker spread:

Conficker spreads in 3 ways.

First, it attacks a vulnerability in the Microsoft Server service. Computers without the October patch can be remotely attacked and taken over by the worm.

Second, Conficker uses 'brute force' tactices to steal Administrator passwords used by local networks and spread them through network shares into the hands of the attackers.

And third, the worm infects removable devices and network shares with an autorun file that executes as soon as a USB device or other infected device is connected to a computer that has been infected.




How to protect yourself:

Conficker will mostly effect businesses that don't regularly update desktops or servers.
Home computers are usually protected and are less at risk. However, a home network can be targeted though.

Make sure you update windows so that the Microsoft patch is applied.
And finally, you can disable Autorun so that a PC won't suffer automatic attack from an infected USB drive or other removable media when it's connected.

To learn more on how to protect yourself from Conficker, please CLICK HERE



If you have been infected, please visit our Malware Removal Forum so we can get your computer cleaned up.