How a Brainy Worm Might Jack the World's PCs on April 1

From Gizmodo -

On April 1, the Conficker worm will activate. And the scariest thing is that there are possibly millions of infected PCs waiting to be linked together on that date to do its bidding. The second scariest thing is that no one really knows what its creator is going to do with this virtual army on that date, when it's scheduled to contact a server for instructions. It's so bad, Microsoft has a running $250,000 bounty for the author, dead or alive.

The NY Times suggests several possibilities, the most sinister being a "Dark Google," that would let bad people scour zombie machines all over the world for data to sell to other bad people.

So what will really happen? Conficker's creator can do whatever he wants with his army. Launch massive denial-of-service attacks, setup the "Dark Google" syndicate, target millions of new machines, or generate a tidal wave of spam that will crash against servers all over the world. But whatever Conficker's results, it will certainly set a terrible precedent: it will lead others to further develop its concept in frighteningly new directions.

How to remove Viruses from USB Drives

Madhur Kapoor has a good tutorial in his blog on how to prevent viruses in USB flash drives from infecting your notebook. Common viruses such as Ravmon, New Folder.exe, Orkut is banned, etc. spread rapidly through such drives and most anti virus programs are unable to detect them and even if they do, in most cases they are unable to delete the file, only quarantine it.

In Windows, one quick way of protection is to check for the files in the USB. A window similar to the shown below pops up whenever you plug in a USB drive:

Don’t click OK , click ‘Cancel’ instead. Open the Command Prompt by typing ‘cmd‘ in the run box. In the command prompt type the drive letter: and press enter . Now type dir /w/a and press enter.

This will display a list of the files in the USB drive. Look for the following files:

• Autorun.inf
• Ravmon.exe
• New Folder.exe
• svchost.exe
• Heap41a
• or any other exe file which may be suspicious.

If any of the above files are present, then the USB drive is likely infected. To delete these, go to the Start Menu -> Run. Enter cmd to run the command prompt.

In command prompt type attrib -r -a -s -h *.* and press enter. This will remove the Read Only, Archive, System and hidden file attributes from all the files in the USB drive. Now delete the files using the command del filename. example del Ravmon.exe. Delete all the files that are suspicious. Now remove the drive and plug it again. In most cases, the culprit will be the “Autorun.inf” file which runs whenever someone clicks OK in the dialog window above.

Alternately, you can also scan your USB drive with an anti-virus program but you need to make sure the anti-virus program has the latest database of viruses. Otherwise it might not be able to recognize the newer viruses.

Another method is to disable the Autoplay feature of USB drives. For this you will need Tweak UI. You can read the instructions on how to use it, as well as to download it, here.