Mobile/PDA About Us Advertise here


		User name	Password

		Not registered yet? Register here. Lost your password? Click here.

Browse by topic

News

Conficker worm finally stirs -- removal advice

10 April 2009 6:31 by James "Dela" Delahunty | 3 comments

The (bad) April Fool's scare caused by the widely spread Conficker variety of malware has been followed by a spring to life by the Conficker worm, according to security firm Trend Micro. The firm has tracked Conficker updates to infected machines over the past few days, hinting that the authors are trying to cash in on their global botnet. Rather than instruct the worm to cause global chaos, it has started downloading fake anti-virus tools to nag users about phony infections and scam them into buying the "product".

It is estimated that as many as 12 million PCs worldwide are infected. The use of bogus software to extort money from uninformed users is nothing new at all, but it can be very profitable to the individuals behind the scam and a total nightmare for anyone who falls into the trap and pays for a clean-up that never happens. The spread of Conficker emphasizes just how many Windows machines are running without Automatic Updates enabled or adequate security software.

DETECTION & REMOVAL

To figure out whether you are infected with the Conficker worm is to try the usual tricks. Firstly, check the websites of common security tools like Symantec, AVG and Avira. If none of those would load, you may be infected, as Conficker blocks access to the sites. Another good test is to check the status of several services (Start -> Run -> services.msc). If Automatic Updates, Background Intelligent Transfer Service, Error Reporting Service or Windows Defender (or other security services you did not disable yourself) have been disabled without your knowledge, or cannot be started, this could be another sign of infection.

If you have any concerns after these checks, then downloading and running a removal tool might be a good idea.

Removal Tools
McAfee AVERT W32/Conficker Stinger - Download!
Symantec W32.Downadup Removal Tool 1 - Download!
Sophos Conficker Cleanup Tool (Stand-Alone Computer) - Download!
Sophos Conficker Cleanup Tool (Network Removal) - Download!
Eset Win32/Conficker Worm Removal Tool - Download!

Anti-Virus
Avira AntiVir Personal - Download!
AVG Free Edition - Download!

Microsoft Patch
MS08-067 - addresses a vulnerability in Microsoft Windows (KB 958644) - Download!

Permalink to this article

Windows flaw spells BSOD risk to newer operating systems (8 September 2009)

P2P botnet creator dodges jail sentence (29 April 2009)

« Previous news article
Author's Guild receives protests over Kindle 'text-to-speech' stance

Next news article »
Researchers warn of P2P 'guilt by association' attack

Post your comment

Discuss this article!
SProdigy (Member) 10 April 2009 9:53
SuperAntiSpyware or Malwayrebytes Antimalware are good choices too. Just be careful when using Malwareybytes software, as it has a habit of deleting system files, particularly the userinit.exe file, which allows you to login to Windows (your system will startup and then immediately logout if it is deleted/not found). This can be fixed easily by copying the userinit.exe file from another Windows XP system into your Windows\System32 directory. [ + quote]
ElTwo (Newbie) 10 April 2009 21:09
*Quote:* Just be careful when using Malwareybytes software, as it has a habit of deleting system files That's not the definition of a "good choice." [ + quote]
SProdigy (Member) 11 April 2009 17:11
*Quote:* *Quote:* Just be careful when using Malwareybytes software, as it has a habit of deleting system files That's not the definition of a "good choice." Yeah, but... sometimes Windows system files do become infected or are replaced with malware. Every AV product is known for having false positives (McAfee Enterprise had issues with previous versions of SpySweeper for example, deleting a necessary SS dll file.) Malwarebytes actually removes alot more junk; usually most people won't bother with crap like conficker and just format their machine, sometimes when it's unnecessary. [ + quote]