Even though it may seem that the virus has been maintaining a low profile for the past few days, security experts warn that the virus is still a threat. In reality, it has already attacked thousands of personal computers in India and nearly 15 million computers globally till date.

So how do you protect your PC from this devastating worm? You can, if you are able to spot whether your PC is infected by it. How do you do that?

Thanks to Joe Stewart, director of malware research at SecureWorks, you can now see if your computer is affected by Conficker with a simple eye test. Stewart came up with a Conficker Eye Chart, which is a simple visual test you can use to evaluate a PC just by surfing to that page and looking at the images. Below the images, there is also a guide on how to interpret the results. It couldn’t be simpler!

However, the test doesn’t work if you’re behind a web proxy.

The worm is programmed to update itself from domains it randomly generates. For the latest version, Conficker C, this amounts to nearly 50,000 domains a day. The virus author needs to use only one of these domains to host the update, thus making tracking nearly impossible.

Use the test to check whether your PC is infected with Conficker and take the necessary remedial measures. To read more on Conficker, click here.

Source: Techtree.com

On its Windows 7 site, Microsoft posted a note saying “The Windows 7 Beta is now available for download.” The Windows 7 site lists a page where the beta can be downloaded.

On Friday, Microsoft struggled to keep its Web site online as users overloaded the company’s servers. Microsoft’s main Web site and the download page the were often unreachable. At the keynote for the Consumer Electronics Show in Las Vegas Wednesday, Microsoft CEO Steve Ballmer said Friday would be the date for beta rollout.

Company officials said activation keys for the code would be capped at 2.5 million, but users who try the beta after that limit is reached will be able to trial it for at least 30 days.

Source: Computer World

Source

Source

Antivirus XP 2008′s Web site looks legit, but caveat emptor.

Yeah, Google.

Apparently, though, the virus is now being spread in more insidious ways, and numerous people who claim safe browsing habits and up-to-date security definitions are being infected–including two of my friends.

In helping them remove it, I discovered an excellent post on the CNET Forums that explained a detailed and accurate method of removal. I’ve retyped it below with more detail in case you’re not able to get to the forums. It’s not particularly complicated, but if you’re not comfortable with advanced settings, I’d recommend proceeding cautiously or get a friend to help.

The scan window from Antivirus XP 2008 also looks legit. It’s also not.

A warning before we begin: do not boot your computer into safe mode. Leave it running as you normally would. I tried restarting into safe mode, and the malware was prepared for that–its folders and files became undetectable.

First, in the Start menu, click on Run. If you can’t find the Run option, hit WIN+R. (That’s the key with the Windows icon on it.)

Type in msconfig, and go to the Startup tab. You’re looking for two files. One begins with the string of letters “lph,” and the second begins with “rhc”. The examples provided are longer strings, “lphc35dj0e1an” and “rhc75dj0e1an”, but after the first three letters, the strings are known to change on different computers. Uncheck the boxes next to both of them, then click on Apply and OK or Close at the bottom of the window.

The scan window from an older version of Antivirus XP 2008.

Restart your computer normally. You’ll notice that the background hasn’t changed. To restore your desktop settings, you’ll need to go to Start > Run again, or Win+R. This time, type in Gpedit.msc. On the left nav, look for User Configuration near the middle. Navigate through Administrative Templates, then Control Panel, and finally Display. When you click on display, you’ll see a list of options open in the central pane. Right click on “Remove Display in Control Panel,” and click “Properties.” Then choose “Disabled.”

Repeat those same steps for the following attributes: Hide Desktop, Prevent changing wallpaper, Hide Appearance and Themes, Hide Settings, and Hide Screen Saver. Change all to “Disabled,” then hit Apply, OK, and restart your computer.

You will still see the Antivirus XP 2008 desktop “theme”, but now you can change it. Anywhere on your desktop, right-click and select properties. The first tab that opens should allow you to change your theme. If you also suffer from massive icons, use the last tab on the right, Settings. In the middle of that tab’s window you’ll see a Screen Resolution option, most likely set to 800×600. Move the slider to the left to choose a more aesthetically appealing resolution.

Source

1. Update the DivX codec to the latest version
2. Update (or even Uninstall) Nero to the latest version
3. Disable Thumbnail View

But, the best (and the least tedious solution), in my opinion, seems to be turning off Data Execution Prevention (DEP) for the culprit, dllhost.exe, in this case. Here are the simple steps you need to take to do this.

1. Right-click on My Computer and select Properties

2. Click on Advanced System Settings

3. Select the Advanced tab, and then Settings under Performance

4. Select Data Execution Prevention

5. Choose Turn on DEP for all programs and services except those I select

6. Click on Add

7. Browse to Windows->System32 directory

8. Select dllhost.exe and click Open

9. Click Ok when Windows warns you

10. Click Ok twice, and you are done

11. You might have to reboot your system, if Windows asks you to, for the changes to take effect. I didn’t have to.

Let’s keep our eyes peeled on more developments in this arena. I’ am going to try implementing PostBooks to see what they have to offer.

Double-click to shut down your PC

Open Notepad and type

shutdown.exe -s -t 00

Note that there are two zeros and not the letter ‘O’.

Save it on the desktop as Shutdown.bat and double-click. Voila, Windows will shut down immediately.