Conficker worm might originate in China



Updated at 9:13 p.m. PDT with information provided by BKIS stating that its free version of BKAV antivirus software can remove the worm from any infected computer.

There's been a lot of fuss about the Conficker worm. And here's the a $250,000 question: what is the origin of the virus?


The firm's conclusion is based on its analysis of the virus' coding. It found that Conficker's code is closely related to that of the notorious Nimda, a virus that wreaked havoc on the Net and e-mail in 2001. At that time, BKIS determined that Nimda was made in China, based on the firm's own data.


Even if this finding by BKIS is credible, it's hardly good news, as it does little to help the authorities lay their hands on whomever is responsible for creating the virus. What it does is narrow in on where to block the return of the virus.



Microsoft and Conficker Cabal, a Microsoft-led ad hoc partnership created to fight against the Conficker worm, have been able to contain about 13 percent of these domain names, a number far from reassuring.

According to Quang Tu Nguyen, CEO of BKIS, there's also a chance that the worm might never return if the owner of the worm, for one reason or another, decides not to continue updating it or fails to do so. This is unlikely, however. Quang also suggests that the next outbreak of the virus might not necessarily be on April 1, as is widely speculated, but rather on any day. The firm does believe that the worm would likely seek to update itself on the April 1.

While this seems worrisome, the update of the virus will only take place on computers that have already been infected with one of Conficker's variants and are connected to the Internet. Currently, the number of infected systems is estimated to be around 10 million worldwide.

Fortunately, it's relatively easy to determine whether your computer is infected. Vu Ngoc Son, manager of BKIS' research center, provided a simple way for you to find out if your computer has the virus.


On the other hand, if the computer fails to do any of those, it's likely that it has already been affected. In this case, try to follow these instructions to remove it, or use BKIS' antivirus software that can be downloaded for free. As a last resort, you can also back up your data and install Windows from scratch, then immediately run Windows Update to install the latest security patches.

Note that even when your computer is currently clean, it doesn't mean you won't get infected. This would depend on what the next update of the worm does. A good rule of thumb is to make sure you keep protection software on your computer updated and keep the system current with Microsoft Update. There is a ton of free and effective antivirus software out there that you can find at

As the current work being undertaken against the Conficker worm is mostly damage control, the best way to decrease the possibility of another outbreak is for everybody to make sure their computers are free of the virus and updated to Microsoft's latest patch.

Related stories:

Latest Conficker worm gets nastier

FAQ: Conficker time bomb ticks, but don't expect boom

About the author



Join the discussion

Conversation powered by Livefyre

Don't Miss
Hot Products
Trending on CNET


Up for a challenge?
