Information and steps to help keep your Windows PC safe from the Conficker/Downadup worm.

 Scroll down for methods to keep the worm off your PC.

As previously mentioned in the Bulletin, Conficker is a new malicious program affecting the Windows operating system.  It is largely spread through networks, but can also be spread through infected USB devices, file sharing, and other methods.  Consequently, the virus may also spread to the personally owned computers of UST faculty/staff and students.  

Here are some simple steps that you can take to ensure your machine is less vulnerable to infection.

If you do not already have the Conficker infection, one of the best things you can do to protect yourself is to download and install all critical Windows security updates.  At a minimum, you will want to be certain that you have downloaded and installed the Windows KB958644 patch.

Also, you will want to ensure that your computer has an effective anti-virus program installed, updated and running.  Symantec Enpoint Protection anti-virus software is available to all UST faculty, staff, and students as a free download.

A good way to tell if your computer has been infected is that Conficker will frequently block access to common anti-virus web sites.  If you are not able to browse to sites like http://www.avg.com, or http://www.sophos.com there is a strong possibility that you may have the Conficker infection.

If you suspect that your machine has been infected with the Conficker worm, there are very good resources online describing the nature of the infection and pointing to tools which can be used to remove it from your computer. 

NOTE: It is highly recommended that you do not attempt to boot your computer into "safe mode" if you suspect that you have the Conficker infection.  Conficker disables the registry keys which allow booting into safe mode.  Attempting to boot into safe mode to remove the infection will likely result in the PC being stuck in an infinite cycle of re-boots, and can only be remedied by having the hard drive re-formatted and Windows reinstalled (losing all data in the process).

Here are some of the available tools designed specifically for removing the Conficker infection.  It is important to note that there are at least four variations of Conficker, and not every removal tool will work on all the variations, nor can they guarantee that every trace of the infection will be removed.  But these tools should help remove the infection and prevent the infection from returning.  Because Conficker will likely prevent access to the web sites on which these tools can be downloaded, we are providing the tools here:

• Microsoft Malicious Software Removal tool
• BitDefender Downadup Removal tool
• Symantec W32.Downadup Removal tool
    

If you do choose to try one of these removal tools, it is recommend that you disconnect your computer from all networks (wired and/or wireless), and temporarily turn off the “on access scanning” on your anti-virus software.  Once the removal tool has completed, turn “on access scanning” back on and re-boot your computer.