... but were afraid to ask!

Microsoft has put together two pages all about the Conficker worm. One page aimed at home users and another for IT pros.

Here are the highlights:

Protection

1. Apply the security update associated with MS08-067. View the security bulletin for more information about the vulnerability, affected software, detection and deployment tools and guidance, and security update deployment information.
2. Make sure you are running up-to-date antivirus software from a trusted vendor, such as Microsoft's Forefront Client Security or Windows Live OneCare. Antivirus software may also be obtained from trusted third-parties such as the members of the Virus Information Alliance.
3. Isolate "unpatched" or legacy systems using the methods outlined in the Microsoft Windows NT 4.0 and Windows 98 Threat Mitigation Guide.
4. Implement strong passwords as outlined in the Creating a Strong Password Policy whitepaper.
5. Disable the AutoPlay feature through the registry or using Group Policies as discussed in Microsoft Knowledge Base Article 953252.
   NOTE: Windows 2000, Windows XP, and Windows Server 2003 customers must deploy the update associated with Microsoft Knowledge Base Article 953252 to be able to successfully disable the AutoRun feature. Windows Vista and Windows Server 2008 customers must deploy the security update associated with Microsoft Security Bulletin MS08-038 to be able to successfully disable the AutoRun feature.

Removal - automatic

• Manually download MSRT on to uninfected PCs and deploy to infected PCs to automatically clean infected systems.

Removal - manual

This seems like a lot of work to me but if you're really stuck this might be your only hope.

One of the perks of playing PC games as opposed to gaming on a console is that you can extend the life of your game through the use of mod packs and add-ons. Games such as Crysis have had their lifespan extended dramatically thanks to a large and well-organized modding community. However, be aware that not all modders are filled with good intentions!

Take for example a modder that went by the name of Xpro132 on the Stream forum. This person was claiming to have tools that gave players access to cool new content in the game Left 4 Dead, but what the people installing these tools got instead was nasty malware.

Fortunately, malware attacks life this are both rare and short-lived since it's not long before forum members become wise to what's going on, but by then quite a bit of damage has been done.

My tips for safer game mod downloads are as follows:

• Download mods from reputable sites and forums only - these are generally well policed by moderators and do-badders are usually shown the door quickly.
• Spend time getting to know the modding community before downloading. Find out the people who are known for previously making good mods.
• Be cautious of newbies making extravagant promises!
• Let other people download mods first and provide feedback ... I hate to say it but good security sometimes involved finding a greater fool willing to take a risk.
• Scan everything with a good antivirus scanner. Additionally, send a copy of the file to Virustotal for a thorough scan.
• If in doubt, don't download and install a mod.

Just because you are installing the latest version of a piece of software on your PC doesn't mean that you are getting the very latest (and most secure components). A good example is offered up by Brian Krebs of the Washington Post.

Users who accept the default installation options for OpenOffice 3.0.1 also will get Java 6 Update 7, a version of Java that Sun Microsystems released last spring (the latest version is Java 6 Update 12).

This is notable because not only could attackers target security vulnerabilities that were fixed in subsequent versions of Java, but Java 6 Update 7 was released prior to Sun's inclusion of a feature known as "secure static versioning," which is intended to prevent Web sites from invoking even older versions of Java that may be present on the user's system.

OpenOffice.org, free substitute to Microsoft Office, was once an application only used by geeks. Now it's being installed by regular users who don't know what Java is and won't have a clue how to update it (or more importantly, that you have to uninstall the old version too).

Keeping a PC fully updated with the latest security updates is no longer a trivial matter. To help keep my PCs updated I use Secunia's PSI scanner. This is a great bit of kit that scans your PC for old, insecure software and offers you advice on how to secure the system, as well as download links to the updates software in most instances. I get a great sense of security from scanning my systems regularly for old software.

For those of you interested in Windows 7, here is the confirmed listing of editions that will be available from Microsoft:

• Windows 7 Starter Edition (aimed at emerging markets)
• Windows 7 Home Basic (aimed at emerging markets)
• Windows 7 Home Premium (primary home edition)
• Windows 7 Professional (primary business edition)
• Windows 7 Ultimate (for consumers who wants everything)
• Windows 7 Enterprise (volume license only)

There are also K, N and KN flavors to satisfy Microsoft's legal obligations.

I spend a lot of my time working with many PCs from a single system using Microsoft's Remote Desktop Connection feature. 99.9% of the time this works out great but there are times when I need to Ctrl+Alt+Del the remote machine. Problem is, the machine I'm working on picks up on the keystrokes and never passes on the key presses ...

So, what do you do? Simple, use Ctrl+Alt+End instead.

Bonus tip: If you work with several machines via RDC then you might find it useful to save the connections settings for later use. From the General tab in Remote Desktop Connection click Save As... and your settings will be available next time you want them (I give the files the names of the machines they connect to).