Conficker camouflages new Windows infections
ID: IRCNE2012051484
Date: 2012-05-01
According to "computerworld", windows PCs infected with Conficker are more likely to be compromised by other malware because the worm masks those secondary infections and makes those machines easier to exploit, a security expert said.
That's the biggest reason why Conficker, although crippled and seemingly abandoned by its makers, remains a threat and should be eradicated, said Rodney Joffe, senior technologist at Neustar and a cybersecurity adviser to the White House.
Last week, Microsoft said that Conficker infected, or tried to infect, 1.7 million Windows PCs in 2011's fourth quarter. Microsoft called on users to strengthen passwords to stymie the malware.
Conficker provides the cover Joffe talked about because of two defensive tactics designed to keep it alive: The worm disables most antivirus software, including Microsoft's Windows Defender and Security Essentials, and switches off Windows' Automatic Updates, the service used by virtually all Windows users keep their PCs patched. It also blocks access to security product websites -- preventing signature updates for antivirus software -- and to the Windows Update website.
Without antivirus software, Conficker-infected systems are unlikely to detect and deflect other malware. And if Automatic Updates is disabled, the machine will not receive any new security patches from Microsoft, leaving it open to attack by new threats that exploit those underlying vulnerabilities.
Users who suspect Conficker infections can use the CWG's tool to confirm that the malware is or is not on their machines. Numerous companies, including McAfee, Microsoft, Symantec and Trend Micro, also offer free Conficker cleaning utilities.