quote

http://blogs.technet.com/msrc/archive/2009/04/01/apr...

We�ve gotten a number of questions from customers asking us if we�ve seen any new activity from the Conficker worm now that it�s April 1, 2009.

We and our partners in the Conficker Working Group have been watching closely and we�ve not seen any new malicious activity from Conficker. We haven�t seen any actions outside of what we expected. We have seen systems infected with Worm:Win32/Conficker.D starting to use the new domain generation algorithm. But we haven�t seen any new variants released or any new attacks levied as a result of this.

While there�s been a significant focus on the April 1 date, customers shouldn�t take it to mean that once April 1 has passed that all the risks around Conficker.D lessen or go away. Like I said on Friday, Conficker.D should remain a manageable cause for concern and it doesn�t go away after April 1. Just like it has on April 1, Conficker.D will continue trying to contact domains using this new algorithm on April 2, April 10, and beyond. This means that even though it hasn�t happened today, a new variant or a new attack could be levied in the future. And so, customers should keep focused and keep doing what they�ve been doing: focusing on ensuring your systems are updated with MS08-067, keeping your security software signatures updated, and cleaning any systems you identify that are infected with any version of Conficker. Remember that we have more information about Conficker for home users, and IT Pros. And the MMPC blog always has good information related to malware.

And of course, we and our partners in the Conficker Working Group will keep focused on our ongoing efforts to protect customers and provide you with updates about the situation as we have them.

Thanks.
Christopher

Conficker Eye Chart
Explanation:
Conficker (aka Downadup, Kido) is known to block access to over 100 anti-virus and security websites.
If you are blocked from loading the remote images in the first row of the top table above (AV/security sites) but not blocked from loading the remote images in the second row (websites of alternative operating systems) then your Windows PC may be infected by Conficker (or some other malicious software).

If you can see all six images in both rows of the top table, you are either not infected by Conficker, or you may be using a proxy server, in which case you will not be able to use this test to make an accurate determination, since Conficker will be unable to block you from viewing the AV/security sites.

http://www.confickerworkinggroup.org/infection_test/...

Now that's got to be the best test yet. Very simple and fast.

Huzzah, I'm not infected! Oh, er, by Conficker, I mean...

I like that test nice and simple.

Did all these disasters happen!!!!!

Trevor