This site is now AnswerTips enabled. Double-click any word for its definition.

Quick Conficker Check

by Bill Hely

conficker_eye_chart

I don’t have any Conficker-infected PCs to test this with, so I can’t say from first-hand experience how definitive an indicator it is. But at the very least it’s a very quick initial check for the presence of the Conficker worm.

It’s a Web page that displays what the publishers call the Conficker Eye Chart.

In theory the Conficker Eye Chart should be accurate, though I have seen a couple of posts in various forums by people claiming that they had the Conficker worm and yet could see all of the images on the Eye Chart. However I must say that the wording of those posts led me to believe that they were made by fairly inexperienced people, who in reality may not have known what they had, if anything.

But it’s certainly worth a try, and if some of the eye chart images don’t appear to you, you’ll know that some sort of action needs to be taken immediately. My recommendation…avg_av_8

AVG version 8.5 detects and removes all current variants of the Conficker worm. AVG has been my preferred anti-virus solution for quite some time. It has done an excellent job of protecting both my home & office computers, and those of many of our clients.

To check out the Conficker Eye Chart…

Click here

Post to Twitter Post to Digg Post to Facebook Post to StumbleUpon

{ 6 comments… read them below or add one }

1 Mike April 15, 2009 at 7:13 pm

I alwas has said,protect computers with full protection softwares.
antivirus,antispyware,firewall,antispam,antiphishing,automatic microsoft windows updates,have a pc tune up software.
I have been using mc afee full protection products,panda internet security,in my home computers(4),iolo system mechanic, and have not been in troubles with my pc’s .
People must know cybernet security,there’s a lot of web pages to know about that,starting in windows manufacturer=Microsoft

Reply

2 Bill Norrie April 17, 2009 at 8:30 pm

Thanks for the latest newsletter – re Conficker – checked and
I’m OK – but then I do have good security measures on all my PCs……… ;-)

However, when I clicked on the link “To check out the Conficker Eye
Chart.”, I received the following warning :
“An error has occurred in the script on this page :Line 64:
Char 1 : Page tracker is undefined : Code 0 : URL mhtml:mid://00000015/ : Do you want to continue running scripts on this page? Yes/No” –
Any idea why this is happening? I’ve never seen this one before……

Cheers
Bill Norrie.

Reply

3 Bill Hely April 18, 2009 at 1:51 pm

Hi Bill.

The reasons for script error messages are myriad, but usually harmless.

You can get a script error message using one browser, while accessing the same webpage with a different browser doesn’t raise any alert at all.

Sometimes it’s in the browser’s interpretation of just what constitutes an “error”, or even whether the browser is configured to show script errors or not. Most browsers can be configured not to report script errors, and more often than not the “error” won’t have any effect on the display or functionality of the page. Not always, but often.

There are so many slightly flaky webpages that still work OK, that many people just disable the script debugging feature in their browser.

To turn off script debugging in Internet Explorer 6:
Tools –> Internet Options –> Advanced Tab –> Disable script debugging

Only slightly different for Internet Explorer 7:
Tools –> Internet Options –> Advanced Tab –> Display a notification about every script error

Then again, browser configuration may be preventing the execution of webpage components such as ActiveX, Java or Active Scripting.

If Microsoft’s ActiveX is used in the development of a website then you’ll encounter problems if Firefox is your preferred browser. ActiveX is the source of many security vulnerabilities and Firefox doesn’t use it.

And so on and so on. As I said, myriad possible reasons.

Firebug [https://addons.mozilla.org/en-US/firefox/addon/1843] is a very useful development, monitoring and troubleshooting tool available as a plug-in for the Firefox browser.

If you want to track down further information that directly relates to your particular circumstances, just do a Google search for part of the exact error message: e.g. “An error has occurred in the script on this page”.

I don’t get any script error in either IE7 or Firefox3. Bear in mind that the error may actually be coming from one of the sites that the Conficker Eye Chart page references, and not from that page itself.

I hope this helps to some degree.

Reply

4 Bill Norrie April 18, 2009 at 8:17 pm

Thanks for your reply, however, the option you suggest for Internet Explorer is already ‘un-ticked’ and both ‘Disable Script debugging’ entries are ticked, but the error message still appears!
I’m using WinXP, and Internet Explorer version 7.0.5739.13 both of which are fully up to date with all patches. I have also carried out a full Virus scan using AVG and also did a full spyware scan using Ad-Aware. In both cases, no problems were reported.
Having carried out a search on Google, most sites recommend the same solution, ie ‘Tools > Internet Options > Advanced Tab > disable Display a notification about every script error’ and ticking the ‘Disable Script debugging’ entries, but my IE7 is configured this way and the error window still appears.
One site suggested that it could be caused by a Pop-Up blocker, so I enabled pop-ups (in Google’s toolbar) for ‘confickerworkinggroup.org’ but this did not help.
Since this problem only seems to be related to ‘confickerworkinggroup.org’ I can only assume that your final suggestion is causing the problem.
However, surely the suggested solutions in the configuration of IE7 should prevent this error message from appearing ?? Otherwise there is little point in these options…………

Reply

5 Bill Norrie April 18, 2009 at 8:27 pm

Further to my post above, I just found that clicking on the ‘Click Here’ link on this page ( http://computerandonlinesecurity.com/threat-warnings/quick-conficker-check/comment-page-1/#comment-937) does not produce the Error !! It only occurs when I click the link on your original email – yet on checking the properties of the two links, they seem to be identical ! The plot thickens………………

Reply

6 faxless loans December 6, 2009 at 3:58 am

Very good post. You write verry good, keep up the good work and I will keep on visiting!

Reply

Leave a Comment

You can add images to your comment by clicking here.