Microsoft:Protect yourself from the Conficker computer worm

Published: March 27, 2009

The Conficker worm is a computer worm that can infect your computer and spread itself to other computers across a network automatically, without human interaction.

If you are an IT professional, please visit Conficker Worm: Help Protect Windows from Conficker.

Am I at risk of having the Conficker worm?

Most antivirus software could detect and block the Conficker worm, so if you have updated antivirus software on your computer, you are at a much lower risk of being infected by the Conficker worm.

If you or your network administrator have not installed the latest security updates from Microsoft and your antivirus provider, and if you have file-sharing turned on, the Conficker worm could allow remote code execution. Remote code execution allows an attacker to take control of your computer and use it for malicious purposes.

Top of page

What does the Conficker worm do?

To date, security researchers have discovered two variants of the worm in the wild.

•	Win32/Conficker.A was reported to Microsoft on November 21, 2008.
•	Win32/Conficker.B was reported to Microsoft on December 29, 2008.
•	Win32/Conficker.C was reported to Microsoft on February 20, 2009.
•	Win32/Conficker.D was reported to Microsoft on March 4, 2009.

Win32/Conficker.B might spread through file sharing and via removable drives, such as USB drives (also known as thumb drives). The worm adds a file to the removable drive so that when the drive is used, the AutoPlay dialog will show one additional option.

The Conficker worm can also disable important services on your computer.

In the screenshot of the Autoplay dialog box below, the option Open folder to view files — Publisher not specified was added by the worm. The highlighted option — Open folder to view files — using Windows Explorer is the option that Windows provides and the option you should use.

If you select the first option, the worm executes and can begin to spread itself to other computers.

The option Open folder to view files — Publisher not specified was added by the worm.

Top of page

How does the Conficker worm work?

Here’s an illustration of how the Conficker worm works.

Here's a visual explanation of how the Conficker worm works.

Top of page

How do I remove the Conficker worm?

If your computer is infected with the Conficker worm, you may be unable to download certain security products, such as the Microsoft Malicious Software Removal Tool or accessing certain Web sites, such as Microsoft Update. If you can't access those tools, try using the Windows Live OneCare Safety Scanner.

Top of page

Where can I find more technical information about the Conficker worm and how can I stay up to date on the Conficker worm?

•	For additional information, see Centralized Information About the Conficker Worm.
•	For more technical information about the Conficker worm, see the Microsoft Malware Protection Center Virus Encyclopedia
•	Bookmark the Microsoft Malware Protection Center portal and the Microsoft Malware Protection Center blog for updated information.
•	For symptoms and detailed information about how to remove the Conficker worm, see Help and Support: Virus alert about the Conficker Worm.
•	To continue to get updated information on security, sign up for the Microsoft Security for Home Computer Users newsletter.

For more information, see How to prevent computer worms and How to remove computer worms.

Keeping your kids safe. What Can You Do?

Keeping your kids safe. What Can You Do?

Your kids’ personal information and privacy are valuable — to you, to them, and to marketers. Here’s how to help protect your kids’ personal information when they’re online.

Check out sites your kids visit. If a site requires users to register, see what kind of information it asks for and whether you’re comfortable with what they tell you. If the site allows kids to post information about themselves, talk to your child about the risks and benefits of disclosing certain information in a public forum. You also can see whether the site appears to be following the most basic COPPA requirements, like clearly posting its privacy policy for parents and asking for parental consent before kids can participate.

Take a look at the privacy policy. Just because a site has a privacy policy doesn’t mean it keeps personal information private. The policy should tell you what the site does with the information it collects; then, you can decide how you feel about it. Remember, if the policy says there are no limits to what it collects or who gets to see it, there are no limits.

Ask questions. If you’re not clear on a site’s practices or policies, ask about them. If the site falls under COPPA, the privacy policy has to include contact information for the site manager.

Be selective with your permission. In many cases, websites need your okay before they’re allowed to collect personal information from your kids. They may ask for your permission in a number of ways, including by email or postal mail. Or, you may give your consent by allowing them to charge your credit card. In addition to considering when to give your permission, consider how much consent you want to give — in many cases, it’s not all or none. You might be able to give the company permission to collect some personal information from your child, but say no to having that information passed along to another marketer.

Know your rights. As a parent, you have the right to have a site delete any personal information it has about your child. Some sites will let you see the information they’ve collected. But first, they’ll need to make sure you really are the parent, either by requiring a signed form or an email with a digital signature, for example, or by verifying a charge made to your credit card. You also have a right to take back your consent and have any information collected from your child deleted.

Report a website. If you think a site has collected or disclosed information from your kids or marketed to them in a way that violates the law, report it to the FTC at ftc.gov/complaint or 1-877-FTC-HELP (382-4357).
More Tips For Parents

Talk, and talk often. Make sure your kids know what information should be private, and what information might be appropriate for sharing. When they give out their personal information, they give up control of who can reach them, whether it’s with a marketing message or something more personal. On the other hand, sharing some personal information may allow them to participate in certain activities or to get emails about promotions and events they’re interested in.

Depending on what they do online, also remind your kids that once they post information online, they can’t take it back. Even if they delete the information from a site, older versions may exist on other people's computers and be circulated online.

Know what sites your kids go to. Talk with your kids about the sites they like to visit. Do some exploring on your own to get to know how the sites work and what privacy settings and controls they offer.

Make agreements. Be sure your kids know what your family has decided is okay — and not okay — to divulge online. Consider writing down a list of the rules your family has agreed on, and posting them where everyone can see them.

Let your kids know you’ll keep an eye on the sites they visit. One option is to check your browser history and temporary files, though keep in mind that older kids may know how to delete these files or keep them from getting recorded. If you’d like more controls, check to see what privacy settings your browser offers or consider software that offers a range of controls. Visit the GetNetWise website to learn more.

Know how your kids get online. Kids may get online using your family computer or someone else’s, as well as through cell phones and game consoles. Know what limits you can place on your child's cell phone — some companies have plans that limit downloads, Internet access, and texting on cell phones; other plans allow kids to use those features at certain times of day. Check out what parental controls are available on the gaming consoles your kids use, as well.

Conficker Worm

There has been a lot of talk about the fast-moving Conficker computer worm. The worm is said to have infected at least 3 million and as many as 9 million PCs and is set to spring to life in a new way on April Fools' Day.

Once a machine is infected, the worm can download and install additional malware from attacker-controlled Web sites. a Conflicker-infected PC is essentially under the complete control of the attackers.

Conficker can spread in three ways.

First, it attacks a vulnerability in the Microsoft Server service. Computers without the October patch can be remotely attacked and taken over.
Second, Conficker can attempt to guess or 'brute force' Administrator passwords used by local networks and spread through network shares.
And third, the worm infects removable devices and network shares with an autorun file that executes as soon as a USB drive or other infected device is connected to a victim PC.

The army of Conficker-infected machines, known as a "botnet," could be one of the greatest cybercrime tools ever assembled. On April 1, many Conficker-infected machines will generate a list of 50,000 new domains a day that they could try. Of that group, the botnet will randomly select 500 for the machines to actually query.

From technet.mictosoft:

Conficker Worm: Help Protect Windows from Conficker

This page is designed to provide IT Pro customers the information they need to help protect their systems from the Conficker Worm, or to recover systems that have been infected.

If you are a consumer, please visit Protect Yourself from the Conficker Computer Worm.

About Conficker

On October 23, 2008, Microsoft released a critical security update, MS08-067, to resolve a vulnerability in the Server service of Windows that, at the time of release, was facing targeted, limited attack. The vulnerability could allow an anonymous attacker to successfully take full control of a vulnerable system through a network-based attack, the sort of vectors typically associated with network "worms." Since the release of MS08-067, the Microsoft Malware Protection Center (MMPC) has identified the following variants of Win32/Conficker:

Worm:Win32/Conficker.A: identified by the MMPC on November 21, 2008
Worm:Win32/Conficker.B: identified by the MMPC on December 29, 2008
Worm:Win32/Conficker.C: identified by the MMPC on February 20, 2009*
Worm:Win32/Conficker.D: identified by the MMPC on March 4, 2009**

	*Also known as Conficker B++
	**Also known as Conficker.C and Downadup.C

What Happens on April 1, 2009?

Systems infected with the latest version of Conficker will begin to use a new algorithm to determine what domains to contact. Microsoft has not identified any other actions scheduled to take place on April 1, 2009. It is possible that systems with the latest version of Conficker may be updated with a newer version of Conficker on April 1 by contacting domains on the new domain list. However, these systems could be updated on any date before or after April 1 as well using the "peer-to-peer" updating channel in the latest version of Conficker.

Protecting PCs from Conficker

Apply the security update associated with MS08-067. View the security bulletin for more information about the vulnerability, affected software, detection and deployment tools and guidance, and security update deployment information.
Make sure you are running up-to-date antivirus software from a trusted vendor, such as Microsoft's Forefront Client Security or Windows Live OneCare. Antivirus software may also be obtained from trusted third parties such as the members of the Virus Information Alliance.
Check for updated protections for security software or devices, such as antivirus, network-based intrusion detection systems, or host-based intrusion prevention systems. The Microsoft Active Protection Program (MAPP) provides partners with early access to Microsoft vulnerability information. For a list of partners and links to their active protections, please visit the MAPP Partners page.
Isolate legacy systems using the methods outlined in the Microsoft Windows NT 4.0 and Windows 98 Threat Mitigation Guide.
Implement strong passwords as outlined in the Creating a Strong Password Policy whitepaper.
Disable the AutoPlay feature through the registry or using Group Policies as discussed in Microsoft Knowledge Base Article 967715. Microsoft released Security Advisory 967940 to notify users that the updates to allow users to disable AutoPlay/AutoRun capabilities have been deployed via automatic updating channels.
NOTE: Windows 2000, Windows XP, and Windows Server 2003 customers must deploy the update associated with Microsoft Knowledge Base Article 967715 to be able to successfully disable the AutoRun feature. Windows Vista and Windows Server 2008 customers must deploy the security update associated with Microsoft Security Bulletin MS08-038 to be able to successfully disable the AutoRun feature.

Cleaning Systems of Conficker

Manually download the Windows Malicious Software Removal Tool (MSRT) onto uninfected PCs and deploy to infected PCs to clean infected systems.

Conficker Timeline

On November 21, 2008, the MMPC identified Worm:Win32/Conficker.A. This worm seeks to propagate itself by exploiting the vulnerability addressed in MS08-067 through network-based attacks. The MMPC added signatures and detection to Microsoft Forefront, Microsoft OneCare, and the Windows Live OneCare Safety Scanner on the same day.
On November 25, 2008, the MMPC communicated information about Worm:Win32/Conficker.A through their weblog.
On December 29, 2008, the MMPC identified the second variant, Worm:Win32/Conficker.B, and added signatures and detection to Microsoft Forefront, Microsoft OneCare, and the Windows Live OneCare Safety Scanner on the same day.
NOTE: Worm:Win32/Conficker.B can be successful against systems that have applied the security update associated with MS08-067.
On December 31, 2008, the MMPC communicated information about Worm:Win32/Conficker.B through their weblog.
On January 13, 2009, the MMPC included the ability to remove both Worm:Win32/Conficker.A and Worm:Win32/Conficker.B in the January 2009 release of the Windows Malicious Software Removal Tool and communicated information about this through their weblog.
On January 22, 2009, the MMPC provided consolidated technical information about Worm:Win32/Conficker.B on their weblog.
On February 12, 2009, the Microsoft Security Response Center (MSRC) released information about domains that Conficker-infected systems try to connect to. Microsoft also announced information on a partnership with technology industry and academic leaders designed to disable domains targeted by Conficker.
On February 12, 2009, Microsoft announced a U.S. $250,000 reward for information that results in the arrest and conviction of those responsible for illegally launching the Conficker malicious code on the Internet. Microsoft's reward offer stems from the company's recognition that the Conficker worm is a criminal attack. Microsoft wants to help the authorities catch the criminals responsible for it. Residents of any country are eligible for the reward, in accordance with the laws of that country, because Internet viruses affect the Internet community worldwide.
On February 20, 2009, the MMPC provided technical information about Worm:Win32/Conficker.C on their weblog.

On March 27, 2009, the MMPC provided more details about the new P2P functionality in Worm:Win32/Conficker.D on their weblog.

Individuals with information about the Conficker worm are encouraged to contact their international law enforcement agencies. Additionally, Microsoft has implemented an Antivirus Reward Hotline, +1-425-706-1111, and an Antivirus Reward Mailbox, avreward@microsoft.com, where tips can be shared.

Keeping kids safe online

Your kids’ personal information and privacy are valuable — to you, to them, and to marketers. Fortunately, there are ways you can safeguard that privacy when your kids are online.

* Check out sites your kids visit, and see what kind of information the sites ask for or allow kids to post.
* Talk to your child about the risks and benefits of disclosing certain information, especially in a public forum.
* Take a look at the privacy policy, which should say what the site does with the information it collects. Then you can decide how you feel about it.
* Ask questions. If you’re not clear on a site’s practices or policies, ask about them.
* Be selective with your permission. In many cases, websites need your okay before they’re allowed to collect personal information from your kids.
* Know your rights. For example, as a parent, you have the right to have a site delete any personal information it has about your child.
* Report a website. If you think a site has collected or disclosed information from your kids or marketed to them in a way that violates the law, report it to the FTC.

Whether to study or socialize, play games or learn something new, it’s likely your kids are spending time online. And as a parent, chances are that you’re spending time thinking about ways to make sure they make smart and safe choices when they do. Among the many choices they’re faced with online is how to deal with their personal information.

The Children’s Online Privacy Protection Act – COPPA – gives parents control over what information websites can collect from their kids. Any website for kids under 13, or any general site that collects personal information from kids it knows are under 13, is required to comply with COPPA. The Federal Trade Commission, the nation’s consumer protection agency, enforces this law.

Thanks to COPPA, sites have to get a parent’s permission if they want to collect or share your kids’ personal information, with only a few exceptions. That goes for information sites ask for up-front, and information your kids choose to post about themselves. Personal information includes your child’s full name, address, email address, or cell phone number.

Under COPPA, sites also have to post privacy policies that give details about what kind of information they collect from kids — and what they might do with it (say, to send a weekly newsletter, direct advertising to them, or give the information to other companies). If a site plans to share the child’s information with another company, the privacy policy must say what that company will do with it. Links to the policies should be in places where they’re easy to spot.