Conflicker virus

Viruses and worms
1

Does anyone know whether Avast will detect the Conflicker virus? The list of viruses on the website is dated Jan 2008 so not much use.

I hear that Sophos are able to detect and clean it, but since it is thought to be spread via USB flash drives I need to know whether Avast will detect it before I can risk using a flash drive in my home PC.

2

Yes; see http://forum.avast.com/index.php?topic=41849.0 for Alwil response, for example. Or do a search on conficker (without the l ;))

3

Check out this link, http://www.avast.com/eng/latest-virus-report.html for a live list Summary of Virus Reports.

I think the win32:Confi {Wrm} is the avast signature/malware name for conficker

4

Hi Navvy,

Well here in the forums they have convinced me that avast has a very good detection rate for this worm,
this does not take away the fact that the best policy against infection is installing the out of band patch
( http://www.microsoft.com/technet/security/Bulletin/MS08-067.mspx )that Microsoft launched against the vulnerability that has been exploited to launch this gigantic worm outbreak on the World Wide Web, also disabling the autorun feature helps, re:
http://isc.sans.org/diary.html?storyid=5695

It is propagated on a grand scale through three main infecting vectors: One of the reasons for infecting so many machines is that Conficker uses multiple infection vectors:

  1. It exploits the MS08-067 vulnerability,
  2. It brute forces Administrator passwords on local networks
    and spreads through ADMIN$ shares and finally
  3. It infects removable devices and network shares by creating a special autorun.inf file
    and dropping its own DLL on the device.

polonus

5

Many thanks for all this info. I’ll be leaving the computer on overnight doing a thorough antivirus scan with the latest updates, and when I do plug in a USB drive I’ll be holding down the left shift key to disable autorun, then scanning the whole drive.