# Is Conflicker a problem we should worry about **URL:** \ **Category:** Factual Questions\ **Created:** [January 23, 2009, 3:33pm UTC](https://boards.straightdope.com/t/is-conflicker-a-problem-we-should-worry-about/482646 "2009-01-23T15:33:11Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![gonzomax](https://avatars.discourse-cdn.com/v4/letter/g/e8c25b/32.png) [@gonzomax](https://boards.straightdope.com/u/gonzomax)\ **Post date:** [January 23, 2009, 3:33pm UTC](https://boards.straightdope.com/t/is-conflicker-a-problem-we-should-worry-about/482646/1 "2009-01-23T15:33:11Z")
Conflicker is the newest worm infecting millions of computers. Some suggest it is waiting to receive new instructions after it is downloaded. Does it get in through emails.? What do these emails look like? If we get it, how do we remove it? ---
**Author:** ![gonzomax](https://avatars.discourse-cdn.com/v4/letter/g/e8c25b/32.png) [@gonzomax](https://boards.straightdope.com/u/gonzomax)\ **Post date:** [January 23, 2009, 7:34pm UTC](https://boards.straightdope.com/t/is-conflicker-a-problem-we-should-worry-about/482646/2 "2009-01-23T19:34:03Z")
I guess not. ---
**Author:** ![dolphinboy](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/dolphinboy/32/330_2.png) [@dolphinboy](https://boards.straightdope.com/u/dolphinboy)\ **Post date:** [January 23, 2009, 7:52pm UTC](https://boards.straightdope.com/t/is-conflicker-a-problem-we-should-worry-about/482646/3 "2009-01-23T19:52:04Z")
I think you meant Conficker not Conflicker… According to McAfee the Risk Assessment is Low. YMMV. [http://vil.nai.com/vil/content/v\_153464.htm](http://vil.nai.com/vil/content/v_153464.htm) ---
**Author:** ![Surok](https://avatars.discourse-cdn.com/v4/letter/s/cc9497/32.png) [@Surok](https://boards.straightdope.com/u/Surok)\ **Post date:** [January 23, 2009, 9:18pm UTC](https://boards.straightdope.com/t/is-conflicker-a-problem-we-should-worry-about/482646/4 "2009-01-23T21:18:30Z")
It doesn’t spread via email, it gets onto machines via an unpatched Windows vulnerability - [MS08-067](http://www.microsoft.com/technet/security/Bulletin/MS08-067.mspx). Microsoft has put out a patch to fix this vulnerability, so you should make sure your Windows is up to date. Problem with this worm is that once it’s infected a computer, it can be difficult to remove. It spreads across local networks, may download other nasties onto your computer or network, and blocks access to security websites to prevent you from updating your AV. Major AV vendors have detection for Conficker/ Downadup/ Kido, and also have dedicated removal tools. If your computer is patched, and you have up-to-date AV, you should be fine. ---
**Author:** ![Tim\_T-Bonham.net](https://avatars.discourse-cdn.com/v4/letter/t/46a35a/32.png) [@Tim\_T-Bonham.net](https://boards.straightdope.com/u/Tim_T-Bonham.net)\ **Post date:** [January 23, 2009, 11:41pm UTC](https://boards.straightdope.com/t/is-conflicker-a-problem-we-should-worry-about/482646/5 "2009-01-23T23:41:54Z")
It isn’t really a problem for you, because it doesn’t damage or destroy info on your computer. Instead, it takes over part of your computer, and uses it to send out SPAM emails. Early malware damaged or erased info on your computer, and wrote sneering messages about it, because that was feeding the ego of the author. This kind of malware is all about making money for them, and so they want your computer to keep working, with you not even aware that it is infected. So generally, most people will only see a slight slowdown in their computer – most won’t even notice that. ---
**Author:** ![GiantRat](https://avatars.discourse-cdn.com/v4/letter/g/e47c2d/32.png) [@GiantRat](https://boards.straightdope.com/u/GiantRat)\ **Post date:** [January 24, 2009, 3:38am UTC](https://boards.straightdope.com/t/is-conflicker-a-problem-we-should-worry-about/482646/6 "2009-01-24T03:38:24Z")
I’m going to disagree with everyone here, as a security professional dealing with this on a daily basis. The variants exploiting this vulnerability use three attack vectors (that we know of so far), and can hose anything with weak password authentication (particularly in regard to admin$ shares). Multiple organizations have been met on sunny mornings to find large numbers of account lockouts because the vulnerability is being used to launch brute force attacks. Patch systems for this vulnerability. We’re still waiting to see what payload deployments may (or, heck, may not) exploit it. This isn’t a good bit of fire to play with.