Conficker Worm
Conficker, also called Downadup, is a worm that attempts to infect vulnerable computers running Microsoft Windows. Once a computer is infected, the worm turns off the service for automatic Windows backups, deletes previous restore points, disables many security services, blocks access to a number of security web sites and opens infected machines to receive additional programs from the malware’s creator. The worm then tries to spread itself to other computers on the same network.
On April 1st, the Conficker worm will begin taking more steps to protect itself from removal. Computers infected with the worm may not be able to get security updates or patches from Microsoft or other security vendors.
To prevent infection by the Conficker worm (and other malware), always follow these guidelines:
- Keep your computer updated with the latest updates and patches.
This includes Windows Update, as well as any other security applications such as anti-virus or anti-spyware software that your department or area may use. - Don’t use “free” security scans that pop up on many web sites.
All too often these are fake, using scare tactics to try to get you to purchase their “full” service. In many cases these are actually infecting you while they run. There is reason to believe that the creators of the Conficker worm are associated with some of these fake security products. If you have any question about the legitimacy of a popup notification on your computer, check with your local computing support. - Turn off the Autoplay feature that will automatically run programs
found on memory sticks and other USB devices.
For guidance on turning off AutoPlay, visit "Change Autoplay Settings" at
http://windowshelp.microsoft.com/Windows/en-US/Help/40f23376-1351-49d5-8d48-5c05d35f2ac81033.mspx
Conficker Eye Chart — Use this chart to help determine if you have been infected by the Conficker worm.
REMOVAL TOOL — If your computer has been infected by the Conficker worm, you can use
this removal tool
to attempt to remove the worm from your computer. (The linked tool is only accessible from UCI domains.)
If you have any questions or concerns, please contact your local computing support personnel, or the NACS Response Center at (949) 824-2222.