Microsoft just put a quarter of a million dollars out as a bounty for the individuals who created Conficker. The entire French Navy spent days offline as a result of Conficker. The New York Times and other sources have reported that 9 million computers worldwide have fallen victim to Conficker, so it's likely you've heard about it at some point. Also called Downup, Conficker can interrupt your typical Windows processes, including Windows Update, so until this worm is put to rest, it's likely to be a news story in the weeks to come.



What is Conficker?

You may have heard it called Downup, Downadup, or Kido, but no matter what it's called, Conficker is a worm that will affect most Windows operating systems that are online today. A worm, essentially, is a program or application that can make copies of itself, and randomly send those copies out to other sources. There are a variety of effects when a worm like Conficker gets loose. Sometimes, they simply eat up enough bandwidth to cause overcrowding on networks. In many other situations, though, including Conficker, the effects are far more tangible and concerning.

Conficker works by using the MS08-067 vulnerability. That's essentially how it spreads from computer to computer. It has the ability to download lots of files, and it can execute each of them. Once it's installed on your computer, it copies itself using a random file name, then adds the code behind the worm to the ?services.exe? process. That makes the entire equation a bit more complicated, because it's so hard to get rid of. Some worms spread via email. Some can spread thanks to a website. This worm, though, can do it all, and what makes the situation more complicated is that USB drives are often the carrier. Many individuals use USB drives to take documents and other important files from one computer to the next, and because of the autorun feature on many computers, the USB drive alone can deliver this worm from place to place.

Noticing Conficker

If Conficker has been installed on your machine, you are probably going to notice a number of things. First, you'll probably note that the Windows processes you have set to auto-run can no longer function like they used to. Most people see this first with Windows Update, but it can also affect Windows Defender, Background Intelligent Transfer Service and the Error Reporting Service. The second thing you may see is that you will be blocked from entering websites that have anything to do with security like an anti virus site or an anti spyware site. Obviously Conficker wants to protect itself, and this is the best way to do so. You may not have access to some of your directories or admin shares either. The final thing you may see if Conficker is installed on your computer is slower network processes. It, like other worms, has the ability to eat bandwidth, and that's part of what you'll be seeing.

You'll probably see many of these things happening before your eyes, but Conficker also comes with problems that you might not get to see. For example, if you are the type who creates system restore points on your computer so you'll have a reference if something catastrophic should happen, your computer will physically delete those points if Conficker is installed. That leaves you nothing to fall back on, and it may put you on a hacker's network, thereby causing your machine and data to be more vulnerable.

Aside from that problem, though, is the fact that no one is sure what Conficker's other motives are. Conficker has the capability to do many things, but it's hard to tell what else might happen with this worm before the cycle begins to end. It's possible that millions will be putting financial data at risk. Moreover, because it could mutate at some point, those who have already taken precautionary measures may still end up at risk of exposing their data thanks to Conficker.

Taking Care of the Problem

If you do have Conficker installed on your machine, you'll want to remove it as soon as possible. You can do this in a number of different ways. Microsoft's site has some fairly extensive instructions on how to manually take it off of your system. Keep in mind that manual removal of Conficker is complicated, and if you don't understand how to work within your computer's registry or you're a bit confused at terms like restricting permissions, this method is best left to the professionals. If manual Conficker removal isn't for you, you could simply download the removal tool from Microsoft's website. Their Malicious Software Removal Tool can help to take the worm off of your computer and get rid of any problem files or registry keys it has left behind.

When you've removed Conficker, or even if you don't have Conficker yet, you'll want to take some precautions. First, install the patch Microsoft released in October. Because people often don't update their computers, many users haven't taken advantage of this simple fix, and it could mean the difference between having a clean computer and having to deal with Conficker.

There are also a number of other strategies you may want to employ. First, your personal security suite is your first line of defense against Conficker and others like it. You'll want anti virus software, anti spyware software, and a firewall. Be sure you update these protections on a regular basis, and scan your computer frequently using these applications to check for problems. Second, be sure to avoid free security scans on websites. Pests tend to lurk there, which makes them problematic. Additionally, don't autorun anything, and don't click on attachments or links that you're not sure about. Be sure to keep your passwords strong, and have a strong security plan for your computer in place at all times.

Conficker may continue to be a concern for many, but tips like these can help you keep your computer safe.