The Mudcat Café TM
Thread #119783   Message #2601749
Posted By: JohnInKansas
31-Mar-09 - 07:37 PM
Thread Name: Tech:April 1 Conficker worm/virus attack for real?
Subject: RE: Tech:April 1 Conficker worm/virus attack for real?
Since threads were combined here, in the third post, by
From: Sawzaw, Date: 30 Mar 09 - 11:36 AM you can find a link to"

http://technet.microsoft.com/en-us/security/dd452420.aspx

This page is intended for IT "professionals" who may need to know how to distribute advice and protection for an organization.

The above site directs "consumers" to a separate page, which is the one linked immediately above by Andrez:

http://www.microsoft.com/protect/computer/viruses/worms/conficker.mspx

Both of the above pages offer the assurance that you are unlikely to be successfully attacked by this worm if your Win2K or later OS is up to date for Microsoft Critical patches, since the main vulnerability used by the worm was patched last October. This is not a 100% assurance, however, since the latest version of the worm also uses other methods.

Assurance is given that most AV programs can detect and disable the worm if definitions are kept current. This leaves the possibility that a new variant might have gotten on your computer if it arrived "between updates" and wasn't immediately recognized.

A "full system scan" with most good AV programs should find any infection present on a computer and should remove the original worm, but it's not completely certain that all AV programs can remove all "effects" if the worm was "executed" and allowed to make channges before it was detected and removed.

At the second link, you can download and run a full system scan of the Microsoft Malicious Software Remover - if you're able to get to the site. This worm attempts to block access to the Malware Remover site.

The Malicious Software Remover can be downloaded, if you can access the page, at:

http://www.microsoft.com/security/malwareremove/default.mspx

It can also be accessed, again if you can get to the site, at any Microsoft Update site, such as:

http://update.microsoft.com/microsoftupdate/v6/vistadefault.aspx?ln=en-us (Vista, US, English site)

Your Windows Start button should show you a "Microsoft Update" button, if not on the rollup then in Programs that will take you to the update site appropriate for your version.

The "last resort," should you be unable to connect to the Malicious Software Remover, is to go to the "Windows Live One-Care" page for a scan and repair:

http://onecare.live.com/site/en-us/default.htm?s_cid=sah

On my Vista machine I got a beta version that ran for about three hours, then failed and told me to come back later. For WinXP (or other) you may be asked to log in for a "free trial" - and if you get this I'd suggest reading carefully (and perhaps printing) the EULA.

There really isn't a "fix" for our few Win98 users, but the second link in this post has a link to advice on "minimizing" the vulnerability.

John