My computer is not up to date, will the conficker affect my computer?

[BillM]

What Happens on April 1, 2009?




Computers previously infected with the Conficker worm will begin to use specially crafted instructions to contact web domains owned by the attackers with the intent to find ways to spread (worm) Conficker to other computers to infect.


What does the Conficker worm do?




We don’t know the purpose of the Conficker worm. We have evidence that the creators of the worm can connect to an infected computer to remotely install software and possibly steal information. What will that software do? Most likely the worm will be used to create a botnet that will be “rented” out to criminals who want to send SPAM, steal IDs and direct users to online scams and phishing sites.

The Conficker worm mostly spreads across networks. If it finds a vulnerable computer, it turns off the automatic backup service, deletes previous restore points, disables many security services, blocks access to a number of security web sites and opens infected machines to receive additional programs from the malware’s creator. The worm then tries to spread itself to other computers on the same network.




How does the worm infect a computer?


Conficker, also known as the Downadup worm, tries to take advantage of a problem with Windows (a vulnerability) called MS08-067 to quietly install itself. Users who automatically receive updates from Microsoft are already protected from this. The worm also tries to spread by copying itself into shared folders on networks and by infecting USB devices such as memory sticks.


Who is at risk?





Users whose computers are not fully patched and receiving updates from GDIT’s System Management agent (SCCM) or directly from Microsoft and who are not running an up to date antivirus product are most at risk.


Ensure your Symantec Antivirus is up-to-date and actively running.


1. Your Symantec Antivirus program should be configured to receive updated signatures that have the latest information to identify and prevent th <<image001.jpg>> e variant of the worm from running on your computer. Please follow these instructions to help determine if your Symantec AV program is up-to-date (you must be connected to the Internet):

1. From your computer, open the Symantec AV console (from the system tray double-click the yellow, PC mouse-looking icon). The icon looks like this: cid:image001.jpg@01C9B1EC.32543F30

2. Check the Program Versions section, the Scan Engine should be 81.3.0.13

3. If the Scan Version is not at this level then call the GDIT IT Service Desk and Support for assistance

4. Next, check your Virus Definitions File section, the version should be at a minimum of 3/29/2009 rev. 3

5. If the version is not current then click the LIveUpdate button à Click the Next button --> It will go out to Symantec's website and automatically download the latest version

6. If your system is prevented (confirm that you have Internet access) from accessing the Symantec website call IT Service Desk and Support immediately for assistance.

7. From the pull-down menu, choose Scan and select Full Scan. Click the Scan button and allow Symantec to perform a complete scan.

8. If Symantec finds a virus please contact the IT Service Desk and Support for assistance.

To reiterate, if your computer does not have the latest Program Version or Virus Definitions or it is prevented from accessing the Symantec website to receive the latest signatures please contact the IT Service Desk and Support and immediately.


Advice to Stay Safe from the Downadup Worm:


* Periodically check the Symantec AV console to ensure you are receiving Program and Virus Definitions and they are not out of date.

* Keep your computer updated with the latest patches. This includes Microsoft Operating and Office updates (every 2nd Tuesday of every Month), and Adobe Flash Player, Acrobat and Reader programs, If you don’t know how to do this contact IT Service Desk and Support to assist you.

* Don’t use “free” security scans that pop up on many web sites. All too often these are fake, using scare tactics to try to get you to purchase their “full” service. In many cases these are actually infecting you while they run. There is reason to believe that the creators of the Conficker worm are associated with some of these fake security products.

* Be smart with your passwords. This includes

o Change your passwords periodically as per GDIT Policy

o Use complex passwords – no simple names or words, use special characters and numbers

Contact Information:



IT Service Desk: http://servicedesk.gdit.com/

IT Expanded Support Line: local to Massachusetts.: 781-455-5020,

Long Distance: 800-663-8315



* GDIT Information Security Risk Manager: 703-818-5187