There is a kick butt Bug supposedly about to hit computers April 1st…but this is no April Fools joke. Read below and if you have any questions call Phil Arnold at 826-2246.
In early March, security researchers identified a new version of the Conficker virus, called Conficker.C. This third variant of the virus, like its predecessors, exploits the vulnerability patched by Microsoft’s security bulletin MS08-067, released in October 2008. While not currently released, it has been confirmed that this virus will become active and malicious on April 1, 2009.
Conficker.C is a major revision of the original virus. This variant includes new functionality that ranges from new infection methods to disabling security tools. The Conficker.C virus will scan and kill processes for security products including disabling: firewalls, patch deployment, and antivirus software.
WHAT TO DO BEFORE APRIL 1ST:
The best defense is to apply Microsoft Security Bulletin MS08-067 to eliminate the vulnerability. Administrators should ensure every system on their network, internal and external, physical and virtual, has the MS08-067 patch applied. Before trying to clean or detect any systems that may be infected with the Conficker virus, administrators must first apply the patch. Attempting to clean systems without first protecting them will only present a never-ending process of Virus removal. By applying MS08-067, administrators will then be able to start the task of scanning for infected devices and restoring them back to their desired state.
WHAT TO DO AFTER APRIL 1ST:
If you have not installed the MS08-067 patch on all systems before April 1st, and systems are infected, researchers claim that you will not be able to apply the patch to the infected systems. You will have to manually remove the virus and then apply the patch. This can leave your system open for re-attack in the timeframe between removing the virus and applying the patch.
Potential New Methods of Attack:
In addition to using internal networks as the means of attack, Conficker.C is believed to use P2P (Peer-to-Peer) networking to infect other vulnerable systems.
In an event that hits the computer world only once every few years, security experts are racing against time to mitigate the impact of a bit of malware which is set to wreak havoc on a hard-coded date. As is often the case, that date is April 1.
Malware creators love to target April Fool’s Day with their wares, and the latest worm, called Conficker C, could be one of the most damaging attacks we’ve seen in years.
Conficker first bubbled up in late 2008 and began making headlines in January as known infections topped 9 million computers. Now in its third variant, Conficker C, the worm has grown incredibly complicated, powerful, and virulent… though no one is quite sure exactly what it will do when D-Day arrives.
Thanks in part to a quarter-million-dollar bounty on the head of the writer of the worm, offered by Microsoft, security researchers are aggressively digging into the worm’s code as they attempt to engineer a cure or find the writer before the deadline. What’s known so far is that on April 1, all infected computers will come under the control of a master machine located somewhere across the web, at which point anything’s possible. Will the zombie machines become denial of service attack pawns, steal personal information, wipe hard drives, or simply manifest more traditional malware pop-ups and extortion-like come-ons designed to sell you phony security software? No one knows.
Conficker is clever in the way it hides its tracks because it uses an enormous number of URLs to communicate with HQ. The first version of Conficker used just 250 addresses each day — which security researchers and ICANN simply bought and/or disabled — but Conficker C will up the ante to 50,000 addresses a day when it goes active, a number which simply can’t be tracked and disabled by hand.
At this point, you should be extra vigilant about protecting your PC: Patch Windows completely through Windows Update and update your anti-malware software as well. Make sure your antivirus software is actually running too, as Conficker may have disabled it.
Microsoft also offers a free online safety scan here, which should be able to detect all Conficker versions