Weblog: News from the Lab [ Sign in ]
Conficker Update
publish time: 2009-4-3 22:28:50

The pandemonium of the latest Conficker threat come April 1st has yielded few problems. If you believed in the media hype, the creator of Conficker was expected to publish an update on the sites that the worm was pre-programmed to visit.  Fortunately, very little happened on “Doom’s Day.” Instead we should expect another variant from the Conficker author at a yet to be determined date in the future.

The Conficker Working Group has an interesting way of helping users identify if they are infected by Conficker without using any anti-virus products, however users should know that this only works for the Conficker worm.
 
After clicking on the “Check for Infections” link you will see the “Conficker Eye Chart.”  
If all is well, you will see this graphic:

  

If you are infected, depending on what variant(s), one or more of the logo images will not be displayed.
 
 
Another story on the Conficker front deals with scam artists banking on people’s fear to sell rogue antivirus.  These fake antivirus ploys are becoming more common, for example I wrote about another case the other day.  
 
According to an eWeek article, scammers are using the Symantec brand name to entice people to purchase a fake antivirus product.  E-mails are being sent to people mentioning Symantec ‘s executives discussing Conficker. These e-mails include a link with an erroneous name of AntiVirus 2009. The outcome is a prompt to direct people on how to make a payment for the fake product.