You know how the news reports tend to be a little on the doom and gloom side, where everything is an OMG Breaking News Crisis!!! and how every weather system on the Weather Channel is over-hyped juuuust a tad, where it's never just cold anymore, it's bitterly cold, and there's never a snowstorm anymore, it's a severe winter storm? By and large, computer worms and viruses tend to be reported the same way, especially by computer security folks and the people who sell antivirus software. Shocking, I know, but it's true.
While the Conficker, Downadup, or whatever you want to call it, and other viruses and worms should not be dismissed or taken lightly, do keep in mind that, so far, this worm has done nothing whatsoever other than replicate itself. They know what the code is, how it works, and how it can be used, but so far whoever wrote it hasn't "unleashed" the wrath of the bot. All these compromised computers could be used in concert to attack something, or to self destruct, or whatever, all on a command from other infected computers. That's how worm bots work, they compromise the infected computers, allowing a hacker to gain control over your computer, or millions of them, and then do the damage. But so far, no commands have been sent, and removal of the worm is relatively easy, painless and free
Read this very carefully:
FAQ: How to protect your PC against the Downadup worm
Note that unpatched (from the October patch) Windows XP and Windows 2000 (and Windows Server 2003) computers are most vunerable, and Vista computers are much less vunerable, since the worm must know the user's login name and password to gain authenticared access to Vista machines. It does use a brute force method to try and obtain your login and password, but mainly it's from a list of common
passwords and variations of them. The brute force attack is a way of getting into a computer that has been patched, but it won't brute force you over the Internet, but rather will try that if you are connected to a LAN (like a corporate or home network) where the server or another computer on the network is infected. Web surfing should not be a concern.
Other than the brute force attack of obtaining
passwords, the other two ways the worm is spreads from machine to machine is when people insert an infected USB memory stick into another computer, and, it's primary method, it pings machines with malformed RPC (remote procedure call) packets in the hope of finding PCs not yet patched with the October update.
Once a machine is infected, is disables access to many security Web sites, as well as the automatic Windows Update. And you'll start getting a lot of random svchost errors, so it's pretty easy to know if you've been infected.
If you've been infected, and even if not, it's a good idea to check the
Microsoft Security Bulletin MS08-067 (KB958644) and run the October patch, anyway. There are patches for all operating systems, including Vista 32-bit and 64-bit, and the patches are free. Click your operating system link, which takes you to the download page, then click the download button.
If you haven't run a Windows Update since, like, September, and you think you're already infected, download and run the
Malicious Software Removal Tool (which should have already been downloaded and run as part of a regular Windows Update) and then download the patch, or run Windows Update.