April 2nd, 2009

Eyeballing Conficker with eye-charts and maps

Posted by Ryan Naraine @ 11:29 am

As expected, the April 1st activation date for the Conficker worm passed without much noise but, as Microsoft and others are explaining, the botnet associated with the worm is very much alive — and still potentially dangerous.

“[This threat] should remain a manageable cause for concern and it doesn’t go away after April 1,” says Microsoft’s Christopher Budd. The malware still lives on millions of Windows machines and could start calling home for instructions at any time.

Now that the crazy hype has died down (hopefully!), it’s important for end users to get reliable information on eyeballing the presence of Conficker on a machine and, if it’s found, disinfection instructions from a Web site that isn’t blocked by the malware.

Because Conficker blocks victims from visiting Web sites for anti-malware vendors, Joe Stewart from SecureWorks has come up with a clever eye-chart (if that gets blocked, try this one) that provides visual confirmation on infections.

This article continues: http://blogs.zdnet.com/security/?p=3080&tag=nl.e539