Many still vulnerable to Conficker

Sophos has sent an alert saying many users still have yet to patch their PCs against the exploit that makes them vulnerable to the Conficker worm.

Sophos’ senior technology consultant Graham Cluley, said in a blog post Thursday, the antivirus company found 11 percent of users who had taken an endpoint assessment test at its Web site did not have the Microsoft OS08-067 patch installed.

The patch, available since October last year, fixes a vulnerability which allows the Conficker worm to infect PCs.

The Conficker saga has been broiling for the last month or so, where it received a swarm of media attention leading up to Apr. 1–when it was expected to detonate. Its real effects were seen about a week later, when it started dropping a mystery payload on infected computers.

Microsoft has also put up a US$250,000 reward for information leading to the arrest and conviction of the criminals behind the worm.

Cluley said in his blog post the 11 percent of infected PCs is “pretty depressing news”, given the press coverage the worm has received.

“It appears that the percentage of computers not patched against the exploit is holding steady,” he added.

The goal of Conficker’s creators remains unclear. While researchers have said the worm’s payload dumping activity indicates a profit motive, such as stealing passwords or spam-generation, Conficker has yet to fully reveal its intended function.

There are a number of tests and checks online, including an eye chart from the endpoint assessment test for the Microsoft patch.

Sophos is offering a tool to remove the Conficker worm from infected PCs, as well.

When to upgrade to Windows 7?

IT shops continue to hold off on Vista upgrades in favor of waiting for Windows 7, but individual corporate circumstances may require some action sooner rather than later.

Gartner Inc., the Stamford, Conn.-based consulting firm recently polled 166 of its US-based clients representing three million PCs, and just under 100 of its European-based clients representing just under one million PCs. Vista adoption continues its slow pace, with roughly half of respondents saying they will not upgrade or are making no plans either way.

In fact, by the end of 2008 only 6% of the organizations had started installing Vista. That’s about half of the number of organizations that had installed Windows 2000 by the same time in its evolution, said Michael Silver, a Gartner analyst and one of the report’s authors.

Only one-third of respondents said they would roll out Vista in 2009 in both North America and Europe.

Get thee off of XP

Skipping Vista does have its consequences. It means that IT shops with four or five-year hardware refresh cycles will have a truncated OS upgrade cycle as they move to Windows 7, Silver said.

Silver advises IT shops to at least move some end users off of XP. “We have a lot of clients that skip an OS and they call us up late in their OSes life,” he said. “They say, we can’t get off of Windows 2000 fast enough. We don’t have the budget and our applications don’t support it anymore.”

XP will only be supported with security fixes until April 2014 and it’s unlikely that most Windows 7 deployments will begin until 2011. A release candidate of Windows 7 is widely expected in September 2009, but it will take a while for third-party applications to support a new release, as is typical.

If IT shops start a Windows 7 deployment in early 2011 it means that, through regular attrition, it will be hard for them to get off XP before Microsoft ends support and the third-party vendors pulling back on their own XP support. Support for XP by third parties is expected to become a problem by 2012, Silver said.

Add Windows 7 to your budget on new and existing PCs for 2011 and 2012.

For IT shops interested in running hosted virtual desktops,  it’s better to run Windows XP on the same hardware than running Windows Vista because XP is less resource intensive and requires less disk space. The tools to manage hosted virtual machines are still in their infancy.

By the time Windows 7 becomes mainstream, virtual desktop infrastructure (VDI) and the management technology that supports VDI should be mature.