Quote:
Originally posted by Teej
http://www.myfoxphilly.com/dpp/news/dpgo_Video_April_Fools_Day_Virus_fc_200903262336060
This thing lies dormant in your PC, and will supposedly activate April 1st (date chosen to either create an interesting news article or to make people suspect it of being a farce)
Apart from what it is and when it's set to go off, nothing else is known. It could brick your PC, it could cue up Rickroll on your PC every 5 minutes.
Microsoft is offering a free scan and a patch to protect against it. Type in "conficker" in wikipedia- links to both the scan and the patch will be found at the bottom of the page.
..sigh lol
Don't be suspicious about it's existence, it really is going to download it's payload on April 1. Keep in mind the exploit Conficker was patched back in October. Also, this variant (Variant C) is an update to previous infections. It doesn't self-propagate like the A variant. If you've been keeping up-to-date, you're fine.
Also, the infection rate of Conficker reached it's peak in Janurary. Not even that peak was as high as the infection rate for MSBLAST.
This variant is a pretty hearty one. It definitely falls into the category of "format is easiest fix." I would advise determining if you're infected before April 1.
Microsoft has been doing bounties since MSBLAST. I want to say that's how they got the guy who wrote SQL Slammer.
My money's on a planned DDoS attack on a significantly noticeable network. That's the only way the timing makes sense. I mean, waiting for months just to send spam or steal passwords/credit card numbers doesn't make sense at all. One thing's for sure, the botmaster is happy with the size and scope of his botnet and is now ready to use it.
Symantec's writeup (They call it Downadup, but it is the same worm):
http://www.symantec.com/norton/security_response/writeup.jsp?docid=2009-030614-5852-99&tabid=1