The University of Arizona
Home

Conficker Alert

Malicious computer software known as Conficker or Downadup has infected millions of computers worldwide and is gaining momentum.  Some of the infections have occurred at The University of Arizona.  Nearly all Microsoft Windows-powered computers can be compromised by Conficker.  Computer security researchers expect that Conficker will enable unauthorized people to gain control of infected computers and the data on them.

Conficker spreads in several ways.  If an infected computer is connected to a network, Conficker will immediately scan the network looking for a particular vulnerability and use it to gain access to another Windows computer.  It can also gain access to a networked computer by guessing the password.  Lastly, it can copy itself to any removable USB-based device, such as a flash drive or camera.  It is then executed when inserted in another computer that has been configured to automatically play USB-based devices.  This flexibility means that more than one defensive measure is needed to minimize the risk of infection.

Windows users should take the following steps (after checking with local technical support for any UA-owned computer):

  • Update the operating system regularly to insure the MS08-067 patch and any future critical security patches are installed, and reboot the computer as required.
  • Use strong computer passwords.
  • Run antivirus software.  Free Sophos software is available for students, faculty and staff (see link below).
  • Update the antivirus software regularly.
  • Configure the antivirus for on-access scanning of all files.  (This is the Sophos default configuration.)

The following steps are advisable but not crucial:

  • Turn on Windows Firewall (turned on by default in XP Service Pack 2 update and in Vista).
  • Disable Autoplay and Autorun (with caution).
  • Disable file sharing (with caution).

These measures will help whether or not your computer or USB drive is infected.  However, if your antivirus software detects Conficker but does not remove it, you will need to use Microsoft's Malicious Software Removal Tool. 

See below for links for the Malicious Software Removal Tool, general information on Conficker, and instructions for each of the defensive measures. 

General Information

Operating System Update