Conficker Virus May Activate April 1st
30 March 2009
FastFacts
- Who: Faculty, Staff, and Students (Windows Users)
- What: Protect your computer from the Conficker virus
- Client Action: Leave your machine on to have it scanned for the Conficker virus
Conficker is a highly infectious computer worm that has infected almost 9 million PCs, according to antivirus company F-Secure. Once a machine is infected, the worm can install additional malware onto the computer.
The Conficker worm that has been receiving a great deal of media attention is scheduled for additional activity on April 1st. Information Technology Services is continuing to search for workstations that may have been infected by this worm. There has been an increase in public reports indicating widespread infections of the worm, which can infect a Microsoft Windows system from a thumb drive, a network share, or directly across a network (if the host is not patched with Microsoft Bulletin MS08-067 (what is Microsoft Bulletin MS08-067?).
A group of security researchers have identified a remote signature to identify workstations infected with Conficker. ITS's scanning software has been updated to recognize this signature, and we are beginning to scan the campus.
If you are in a campus office, please leave your workstation turned on this afternoon and all night so that ITS can remotely check your workstation.
The presence of a Conficker infection may be indicated if a user is unable to surf to the following websites:
If you are unable to reach either of these websites, a Conficker infection may be indicated (the most current variant of Conficker prevents users from accessing these sites). If a Conficker infection is suspected, the infected system should be removed from the network. Major antivirus vendors and Microsoft have released several free tools that can verify the presence of a Conficker infection.
The updates to address the vulnerability that Conficker exploits are available on the Microsoft Update site. You should make an effort to get your workstation(s) patched immediately by running Windows Automatic Update. For instructions on enabling Automatic Update for Windows, please visit Windows Update.
If you suspect that your workstation is infected with Conficker, please contact 6-TECH at (336) 256-TECH (8324) or 6-tech@uncg.edu.