April 9, 2009

In an earlier post I mentioned how people are wondering if their files will transfer to Mac from an existing Windows machine. In that post I talked about running Windows on a Mac if you needed access to a Windows-only program. PC Magazine has a great article on the different methods to accomplish this, if you are comfortable doing it yourself. You can read the article here.

It’s been in the news recently, and we’ve talked about it here in previous posts and newsletters. The Conficker worm came to life yesterday according to TrendLabs, Trend Micro’s blog. It apparently downloads a file from other infected machines via P2P, similar to how file and music sharing services like Limewire work. From the TrendLabs blog:

Trend now detects this new Conficker variant as WORM_DOWNAD.E. Some interesting things (well at least in our perspective) found are:

1. (Un)Trigger Date – May 3, 2009, it will stop running
2. Runs in random file name and random service name
3. Deletes this dropped component afterwards
4. Propagates via MS08-067 to external IPs if Internet is available, if no connections, uses local IPs
5. Opens port 5114 and serve as HTTP server, by broadcasting via SSDP request
6. Connects to the following sites:
   • Myspace.com
   • msn.com
   • ebay.com
   • cnn.com
   • aol.com

It also does not leave a trace of itself in the host machine. It runs and deletes all traces, no files, no registries etc.

A particularly nefarious piece of malware has been in the news a lot lately: Conficker. Also known as Downadup and the April Fools worm, it is very sneaky and difficult to detect. Fortunately, because of its popularity, there has been a lot of research done to figure out ways to stop it from spreading and to remove it from machines that have been infected. The easiest way to determine if you have been infected with Conficker is to use the Conficker eye chart (available here). Part of Conficker’s programming is to block access to well-known security software vendors’ websites, such as Symantec and Trend Micro. The “eye chart” has a legend that explains what you should see if you don’t have Conficker, and also what you see if you do have Conficker. If the chart appears normal, then you most likely haven’t been infected; if there are some images missing, then you probably have Conficker. Don’t panic though, it can be fixed. You can access a list of steps to remove Conficker here, or you can give us a call. Even if you don’t have Conficker, make sure you have the latest version of your preferred security software and that it’s up-to-date. We recommend Norton Internet Security 2009 (available here).

Do you backup? Should you? Backing up ensures that your information is not affected should anything happen to your computer’s hard drive. It can be as simple as copying your files to an external hard drive once a month, or you could use an online backup service that automatically backs up changed and new files every night. Let’s put it this way: If something were to happen to your computer and you lost everything on it, what files would you absolutely have to have? Professional data recovery services usually start around $1,200 and increase exponentially based on the size of your hard drive. What information on your computer would you be willing to pay that much to get back? Read the rest of this entry »