April Fools Virus: Conficker C Removal Tool

Update: April 1 is here, and no real activity from the Conficker C worm.

While reports have surfaced of infected machines calling for (possible) further instructions, nothing has actually happened yet. This could be by design, or the entire point of the April Fool's worm: an April Fool's joke. Either way, if you're a PC user, you should have already run the Sophos removal tool and double-checked wiht the MS diagnostic, both linked below.

Also, check out this "eye-chart" Conficker detection method: apparently it's more precise than a generic system scan.

I've never seen a piece of malicious code get this much press before, and almost wrote a cyberpocalyptic April Fool's story about it.. but didn't have the heart.

Update: One day to go before the Conficker C worm (aka "April Fools Worm) self-activates. PC owners are scouring the web looking for solutions, checking in with Symantec and MSN for answers (Check below to save yourself the headache). I bet quite a few are doing full re-installs, just to be sure. The US Department of Homeland Security released an anti-Conficker tool that's freely available to... itself. Thanks, guys. I suggest checking out wither the link below, or the latest MSRT (Malicious Software Removal Tool) from Microsoft.

Meanwhile, it's past midnight in Australia and I'm not hearing of any mass worm-borne chaos, so perhaps this is the desired effect of the infection.

Update: There's a break in the Conflickr C worm hunt: Honeynet Project, a German research group, was able to fingerprint Conflickr malware on infected machines. However, the diagnostic tools used are enterprise-caliber, most likely used by businesses, and not by individuals. Two days remain before the worm does... whatever it's supposed to do.

The mysterious and virulent Conficker C worm continues to metastasize across the Internet, leaving infected PCs in its wake. I say "mysterious" because nobody seems to know what Conficker C actually does, beyond replicating itself. The security community is saying that this is only the first stage of the worm's attack: once the botnet is created, then it will reach out on April 1 to get directions from whom/whatever controls it. (Before we go any further, here's the Conficker Removal Tool, courtesy of Sophos)

It could be a big April Fool's hoax (oh, I hope so), but either way its high media profile draws attention to the overall threat of PC infection. Indeed, Conficker C isn't necessarily more spreadable than the myriad other threats out there, but the April-1st angle has a sexy scare element to it.

Meanwhile, Canada (or its domain embodiment, .ca) is dead-set to make sure the welcome mat is not rolled out for the worm.

Oh, and if you think you're safe with IE8... you're not. At all.