Conficker virus could be deadly threat – or April Fool's joke

It could be the biggest April Fool's joke ever played on the internet, or it could be one of the worst days ever for computers connected to the network. Security experts can't work out whether the Conficker virus – which has infected more than 10m Windows PCs worldwide – will wreak havoc on Wednesday , or just let the day pass quietly.

Experts have worked out that from midnight on 1 April, the Conficker program will start scanning thousands of websites for a new set of instructions telling it what to do next. The infected machines thus comprise one of the biggest "botnets" – a network of "robot" computers – in internet history. And if they were all given a target, such as simultaneously sending search queries to Google or trying to connect to a gambling site, they could knock it offline through the sheer volume of connections – a "denial of service". Victims usually discover that they have been locked out of their computers or have very slow-running internet connections.

Botnets have been used in the past to generate millions of pieces of spam email and to blackmail gambling sites that need to stay online during sports events with the threat that they will be deluged by a "denial of service" attacks.

Careful study of infected machines has revealed that from midnight on Wednesday they will seek new instructions from a randomly generated list of thousands of websites that changes every day. Just one needs to be under the virus writers' control to turn Conficker into a newly configured botnet – making the task of catching the exact site a search for a needle in a computing haystack.

Experts admit that they have little idea of where Conficker might be headed next. "It's a brave man who puts his neck out like that," said Graham Cluley, an analyst with internet security company Sophos. "For what it's worth, we have never seen earlier versions of the Conficker worm downloading a malicious payload."

He added that the April Fool's Day deadline could be an attempt to misdirect the attention of security professionals and computer users – or that the activation date could even indicate a prank.

"There is no reason to believe that there will be any instructions for Conficker to receive on 1 April," he said. "They could just as easily be delivered on 2 April, 4 April, 25 May or never."

Others agree that Conficker may not activate immediately, preferring to lie in wait before receiving further orders to avoid scrutiny. "At its core, the main purpose of Conficker is to provide the authors with a secure binary updating service that effectively allows them instant control of millions of PCs worldwide," noted Philip Porras of SRI International. Vincent Weafer, vice-president of Symantec, an internet security company, said: "Most malware these days is designed to be used for some type of criminal monetary gain, and conducting such criminal acts typically requires stealth measures to be successful.

"This makes the odds that a major event will take place on 1 April even less likely, since there is so much attention being paid to that day."

Conficker – also known among security experts as "Downadup" – was first discovered in November last year, being sold as part of a "kit" by a Chinese hacker. Since then, two variants have been spotted as the virus has gone on to infect more than 10m PCs.

Despite being tracked for several months, however, the truth about Conficker's motivations and origins remain clouded. Last weekend, one team of researchers suggested that they may have discovered a "fingerprint" inside the worm which should make it possible to scan computers for the infection, making removal easier.

The identity of its creator remains unknown, despite Microsoft offering a bounty of $250,000 (£176,000) for the information. Usual methods of unpacking the virus code to examine its workings have been thwarted because the authors have encrypted it, using algorithms that render it almost uncrackable.

In the meantime, Conficker has gone on to become one of the most widespread internet worms in recent years.

Last week a leaked memo revealed that the House of Commons computer system had become infected, leading to concerns that confidential or highly sensitive material could be stolen when the virus next updates.

In the document, Joan Miller, the director of parliamentary computer services, said that her team were "continuing to work with our third party partners to manage its removal and we need to act swiftly to clean computers that are infected".

Ordinary PC users are being advised to keep their anti-virus software up to date and watch for news about the worm. Cluley suggested that the widespread coverage could help lessen the potential impact. "Most businesses appear to have Conficker under control," he said. "They've applied patches and updated their anti-virus software to stem the spread of the worm. Some firms struggled to clean it up quickly – but most have now used some of the free Conficker removal tools available for download from security vendors."

http://www.guardian.co.uk/technology/2009/mar/30/conficker-virus-computing


Make sure you keep your AV updated guys.

 

it sux getting owned.

 

Yeah, I got an email from campus IT services about it. But, the email said "Windows users: ...," so I trashed it XD

They recommended running McAfee to find/delete old infections of the virus (VirusScan successfully blocks new ones):
http://vil.nai.com/vil/conficker_stinger/Stinger_Coficker.exe (link launches download)

Takes about an hour, supposedly, but you can leave the comp running while you do it.

 

Not worried at all.

@_@. Well, a little bit. I just tweaked my firewall max protection XD.

 

http://www.sythe.org/showthread.php?goto=newpost&t=592249

I don't see why people are "preparing" for it... There are some security measures that people should have always taken, not just for this situation...

Just turn your computer off the night before and leave it on or something.

Maybe I'll use it as an excuse not to do my homework.

 

I'm not sure how this virus knows when it's 1 April...maby by a command received or just by your Windows Clock.
But you could always try to put your PC date to 2 April already maby that helps.

Edit post count 666!

 

They always say that crazy viruses will hit on April 1st every year and it has never happened yet, so I don't believe it at all.

 

Download Comodo free firewall while you are it.

 

I am not worried what so ever.

• I don't share networks
• I don't join random Networks
• I haven't been downloading anything
• I have the latest Microsoft Updates/and Patches
• They will be hacking Business's and company's
• Skiddies will try to hack home computers
• Also have a Hard password, they won't brute force anything so they won't get thru.

 

Should I be worried about that.

lol...

I have internet but just a wee x over it. XDD

 

So did anything come of this?

@Teldara, no you don't need to be worried

 

I do not think so.... :/

 

Something to keep in mind - just because conficker didn't do anything today, doesn't mean it has stopped spreading or its effects no longer working.

 

Also, always keep your head up for anything. Better safe than sorry. You should always be on the lookout for viruses; after all, this isn't the only virus on earth...=|

 

Yea this is probably the biggest virus attack EVER..Millions of computers are getting infected every second and they dont even know it..Its just waiting to unleash..Just like HIV xD

 

Yeah, it didn't do much today, as it was "supposed" to. but it probably will very soon or sometime in the near future.

 

If this is an April Fool's joke, then kudos to them, if not then holy shit put on all your firewalls and antivirus!

 

i read that they heard somewhere that the mastercomputer guy lol might wait for all the hype to go down then send a attack, go to www.cnn.com if u think u might have it, check some of thier articles they have sites that will check for u.

 

Firewall is shit. Get better protection because firewall won't do much. Unless you have a insane version of it.