SANDY BERGER: New Anti-Virus Program Can Thwart Conficker

Advertisement

Did you hear that the Conficker worm was going to take down the Web on April 1, 2009? Did all the hype in the news make you fear that your computer was infected?

If you watched a recent episode of "60 Minutes," you might have grave fears that the Conficker virus will take down the Web and/or steal your personal information. However, this television show, like much of news coverage on Conficker, did not give the whole story. If you have a good antivirus program and have done your Windows updates regularly, you probably won't have any trouble with Conficker. Let me give you the whole story.

Conficker, also known as Downandup, is a computer worm that spreads in three different ways:

n Conficker's main attack mechanism is that it spreads over the Internet by taking advantage of a hole in the Windows operating system. Microsoft released a patch for this vulnerability in October 2008. Conficker appeared shortly after that, quickly infecting millions of computers.

The patch was released before the virus, so anyone doing regular Windows updates will not have the vulnerability. All the major antivirus programs, including the free versions of AVG and Avast, will currently detect all versions of the Conficker worm. Computers that do not receive the regular Windows updates are very susceptible to Conficker.

It is estimated that more than 30 percent of the Windows computers in the world are running bogus versions of Microsoft Windows that cannot receive the proper updates because they are unregistered copies. So you can see why Conficker has spread so quickly.

n Conficker also spreads by removable USB devices. Although there have been viruses spread from digital picture frames and other devices, it is the first major virus to take advantage of this transmission method. It uses the AutoPlay pop-up that appears when you plug in a USB device to trick you into installing the virus.

To be completely safe, you can shut down AutoPlay, but this is a complicated process, and it requires editing the Registry, which is a dangerous proposal for most PC users. Instead, I suggest that you use your antivirus software to scan any removable device that you attach to your computer.

Most anti-virus software programs can be set to do this for you automatically. If you don't know how to set this up, check with your antivirus provider.

n Conficker is also smart enough to gain access to networks by using automated methods of guessing network passwords. This is how many networks are being infiltrated.

Weak passwords that are a combination of names and/or words allow Conficker entry to the network where it can then spread through shared folders. This password guessing is probably how Conficker attacked the CBS television computer network.

Although most home users don't have to worry about this, it is a wakeup call for everyone to use more complex passwords.

The Conficker worm is very smartly written. There are already three versions, each one smarter than the previous one. Each version is set to call the virus creator for instructions on certain dates to give the millions of infected computers their instructions on what to do next.

Several dates such as Jan. 1, 2009, and April 1, 2009, have already passed, but the infected computers are still under the control of the hackers. They might be instructed to simply call again later to mount an attack against a certain computer network, such as a governmental entity, or to transmit passwords and/or financial or other personal information from the infected computers.

If you think your computer might be infected, make sure that your anti-virus program is up to date and run a scan of the entire computer. One sure sign that you are infected with Conficker is if you cannot get to Web sites of anti-virus manufacturers like Symantec and/or Mcafee.

Removal tools for Conficker are available from software manufacturers such as Microsoft, BitDefender, ESET, Symantec, Sophos, Kaspersky Labs and others. But if you are infected, you probably won't be able to get to these Web sites to access the removal tools. If that is the case, you will have to download the tools from another computer or take your computer to a professional for thorough cleaning.

Sandy Berger welcomes all of your questions and comments on today's column. Please post them on the Compu-Kiss Message Board at www.compukiss.com/happycomputing.

Advertisement

Comments

Use the comment form below to begin a discussion about this content.

Comments No Longer Accepted
Pinestraw Magazine