How to Survive Super-Worm

A super nasty computer virus, Conficker, is due to strike tomorrow, April Fool’s Day. Here are two useful articles that may help.

~Eowyn

………

Last-minute Conficker survival guide

Tue Mar 31, 2009 1:42PM EDT

http://tech.yahoo.com/blogs/null/132464

 

Tomorrow — April 1 — is D-Day for Conficker, as whatever nasty payload it’s packing is currently set to activate. What happens come midnight is a mystery: Will it turn the millions of infected computers into spam-sending zombie robots? Or will it start capturing everything you type — passwords, credit card numbers, etc. — and send that information back to its masters?

 

No one knows, but we’ll probably find out soon.

 

Or not. As Slate notes, Conficker is scheduled to go “live” on April 1, but whoever’s controlling it could choose not to wreak havoc but instead do absolutely nothing, waiting for a time when there’s less heat. They can do this because the way Conficker is designed is extremely clever: Rather than containing a list of specific, static instructions, Conficker reaches out to the web to receive updated marching orders via a huge list of websites it creates. Conficker.C — the latest bad boy — will start checking 50,000 different semi-randomly-generated sites a day looking for instructions, so there’s no way to shut down all of them. If just one of those sites goes live with legitimate instructions, Conficker keeps on trucking.

 

Conficker’s a nasty little worm that takes serious efforts to bypass your security defenses, but you aren’t without some tools in your arsenal to protect yourself.

 

Your first step should be the tools you already have: Windows Update, to make sure your computer is fully patched, and your current antivirus software, to make sure anything that slips through the cracks is caught.

 

But if Conficker’s already on your machine, it may bypass certain subsystems and updating Windows and your antivirus at this point may not work. If you are worried about anything being amiss — try booting into Safe Mode, which Conficker prevents, to check — you should run a specialized tool to get rid of Conficker.

 

Microsoft offers a web-based scanner (note that some users have reported it crashed their machines; I had no trouble with it), so you might try one of these downloadable options instead: Symantec’s Conficker (aka Downadup) tool, Trend Micro’s Cleanup Engine, or Malwarebytes. Conficker may prevent your machine from accessing any of these websites, so you may have to download these tools from a known non-infected computer if you need them. Follow the instructions given on each site to run them successfully. (Also note: None of these tools should harm your computer if you don’t have Conficker.)

As a final safety note, all users — whether they’re worried about an infection or know for sure they’re clean — are also wise to make a full data backup today.

 

What won’t work? Turning your PC off tonight and back on on April 2 will not protect you from the worm (sorry to the dozens of people who wrote me asking if this would do the trick). Temporarily disconnecting your computer from the web won’t help if the malware is already on your machine — it will simply activate once you connect again. Changing the date on your PC will likely have no helpful effect, either. And yes, Macs are immune this time out. Follow the above instructions to detect and remove the worm.

 

……………..

 

How to tell, what to do if computer is infected (AP)

Posted on Sun Mar 15, 2009 12:46PM EDT

http://tech.yahoo.com/news/ap/20090315/ap_on_hi_te/tec_inside_a_botnet_checklist

 

Computer-virus infections don’t cause your machine to crash anymore.

Nowadays, the criminals behind the infections usually want your computer operating in top form so you don’t know something’s wrong. That way, they can log your keystrokes and steal any passwords or credit-card numbers you enter at Web sites, or they can link your infected computer with others to send out spam.

 

Here are some signs your computer is infected, tapped to serve as part of “botnet” armies run by criminals:

 

• You experience new, prolonged slowdowns. This can be a sign that a malicious program is running in the background.

 

• You continually get pop-up ads that you can’t make go away. This is a sure sign you have “adware,” and possibly more, on your machine.

 

• You’re being directed to sites you didn’t intend to visit, or your search results are coming back funky. This is another sign that hackers have gotten to your machine.

 

So what do you do?

 

• Having anti-virus software here is hugely helpful. For one, it can identify known malicious programs and disable them. If the virus that has infected your machine isn’t detected, many anti-virus vendors offer a service in which they can remotely take over your computer and delete the malware for a fee.

 

• Some anti-virus vendors also offer free, online virus-scanning services.

 

• You may have to reinstall your operating system if your computer is still experiencing problems. It’s a good idea even if you believe you’ve cleaned up the mess because malware can still be hidden on your machine. You will need to back up your files before you do this.

 

How do I know what information has been taken?

 

• It’s very hard to tell what’s been taken. Not every infection steals your data. Some just serve unwanted ads. Others poison your search result or steer you to Web sites you don’t want to see. Others log your every keystroke. The anti-virus vendors have extensive databases about what the known infections do and don’t do. Comparing the results from your virus scans to those entries will give you a good idea about what criminals may have snatched up.

Advertisement