Don't let Conficker worm make you an April fool

BANGALORE, INDIA: This April Fools' Day could be one of the worst days ever for computers connected to the network, warn security experts.

In all possibility the fast-moving Conficker computer worm, which has infected millions of PCs worldwide, will spring to life in a new way on April Fools' Day and wreak havoc, they fear.

Conficker, which is also known among security experts as 'Downadup', came to the notice of the experts in November 2007. It was being sold as part of a 'kit' by a Chinese hacker. Since then, two variants have been spotted and Conficker became a widespread Internet worm.

However, no one knows as to where it has originated or what are Conficker's motivations. Microsoft had even offered a bounty of $250,000 for the information leading to the creator of this worm.

The worm is programmed to modify itself on Wednesday, April Fool's Day, according to computer security specialists. It has been programmed to reach out to 250 websites daily to download commands from its masters, but on Wednesday it will begin connecting with 50,000 websites daily for instructions, they warn.

How does Conficker work?

The Conficker worm has been designed in such a way that it can infect your computer and spread itself to other computers across a network automatically, without human interaction.

The worm attempts to make numerous connections to the computers across the network from infected System finding new hosts, resulting in a "denial of service" attacks.

This enables the creators of the worm to trigger the program to send spam, spread more infections, clog networks with traffic, or try and bring down Web sites.

It is possible that computers on the network without latest security updates may get infected with the worm.

Usual methods of unpacking the virus code will not work here, as the authors of the virus have encrypted it using algorithms that render it almost uncrackable.

Though it is feared that the worm can infect many a network globally, some experts feel that April 1 will probably come and go quietly and the worm will not create much of a problem.

According to Graham Cluley, an analyst with Internet security company Sophos the April Fool's Day deadline could be an attempt to misdirect the attention of security professionals and computer users.

"There is no reason to believe that there will be any instructions for Conficker to receive on 1 April. They could just as easily be delivered on 2 April, 4 April, 25 May or never," he said.

"Most malware these days is designed to be used for some type of criminal monetary gain, and conducting such criminal acts typically requires stealth measures to be successful,” according to Vincent Weafer, vice-president of Internet security company Symantec.

"This makes the odds that a major event will take place on 1 April even less likely, since there is so much attention being paid to that day," he adds.

But no one knows whether the creators of this worm have any financial motive as such.

Meanwhile, the US Department of Homeland Security released a tool on Monday to detect whether a computer is infected by Conficker. The tool has been developed by the US Computer Emergency Readiness Team (US-CERT).

The patch is designed to prevent an attacker from remotely taking control of an infected computer system and installing additional malicious software, said an official statement.