Home IT Alerts

UPDATE (April 1): Important information on worm activity

This is an update to our earlier message regarding Conficker.C worm activity. As of the morning of April 1, 2009, no major Conficker.C activity has yet emerged on the University of Michigan campus networks.

Using a combination of network vulnerability scanning tools, Safe Computing scanned the entire campus network for signs of machines infected with Conficker.C. One infection was found, although various network filtering devices such as firewalls prevent us from scanning every machine.

Additionally, we have been monitoring network traffic between the University and the Internet for signs of worm activity and other abnormal traffic. We are investigating one network anomaly, but we don't believe it is related to the Conficker.C worm.

ACTION ITEMS: While no significant worldwide Conficker.C activity has yet emerged, there is still a possibility that issues could arise. We will continue to scan for infected hosts as long as necessary. We would also ask technical staff to remain on alert throughout the day, as we may still call upon you to take urgent action.

Please continue your own scans and contact security@umich.edu if you find an infected host. Tools for scanning will be posted to http://www.safecomputing.umich.edu/ITProfessionals.php as they are available.

Please direct any questions or concerns to security@umich.edu.

REFERENCES

March 30 Conficker advisory from Safe Computing
http://www.safecomputing.umich.edu/Alerts/03.30.09%20-%20conficker.php

eEye's Conficker Worm Free Scanner
http://www.eeye.com/html/downloads/other/ConfickerScanner.html

Microsoft Malware Protection Center
http://www.microsoft.com/security/portal/Entry.aspx?Name=Worm:Win32/Conficker.C

McAfee - Conficker Activation On April 1st
http://www.avertlabs.com/research/blog/index.php/2009/03/31/conficker-activation-on-april-1st

F-Secure - Conficker - What's going on?
http://www.f-secure.com/weblog/archives/00001644.html