Conficker worm finally stirs -- removal advice

Conficker worm finally stirs -- removal advice
The (bad) April Fool's scare caused by the widely spread Conficker variety of malware has been followed by a spring to life by the Conficker worm, according to security firm Trend Micro. The firm has tracked Conficker updates to infected machines over the past few days, hinting that the authors are trying to cash in on their global botnet. Rather than instruct the worm to cause global chaos, it has started downloading fake anti-virus tools to nag users about phony infections and scam them into buying the "product".

It is estimated that as many as 12 million PCs worldwide are infected. The use of bogus software to extort money from uninformed users is nothing new at all, but it can be very profitable to the individuals behind the scam and a total nightmare for anyone who falls into the trap and pays for a clean-up that never happens. The spread of Conficker emphasizes just how many Windows machines are running without Automatic Updates enabled or adequate security software.



DETECTION & REMOVAL

To figure out whether you are infected with the Conficker worm is to try the usual tricks. Firstly, check the websites of common security tools like Symantec, AVG and Avira. If none of those would load, you may be infected, as Conficker blocks access to the sites. Another good test is to check the status of several services (Start -> Run -> services.msc). If Automatic Updates, Background Intelligent Transfer Service, Error Reporting Service or Windows Defender (or other security services you did not disable yourself) have been disabled without your knowledge, or cannot be started, this could be another sign of infection.

If you have any concerns after these checks, then downloading and running a removal tool might be a good idea.



Removal Tools
McAfee AVERT W32/Conficker Stinger - Download!
Symantec W32.Downadup Removal Tool 1 - Download!
Sophos Conficker Cleanup Tool (Stand-Alone Computer) - Download!
Sophos Conficker Cleanup Tool (Network Removal) - Download!
Eset Win32/Conficker Worm Removal Tool - Download!



Anti-Virus
Avira AntiVir Personal - Download!
AVG Free Edition - Download!

Microsoft Patch
MS08-067 - addresses a vulnerability in Microsoft Windows (KB 958644) - Download!

Written by: James Delahunty @ 10 Apr 2009 6:31
Advertisement - News comments available below the ad
  • 3 comments

  • SProdigy

    SuperAntiSpyware or Malwayrebytes Antimalware are good choices too.

    Just be careful when using Malwareybytes software, as it has a habit of deleting system files, particularly the userinit.exe file, which allows you to login to Windows (your system will startup and then immediately logout if it is deleted/not found).

    This can be fixed easily by copying the userinit.exe file from another Windows XP system into your Windows\System32 directory.

    10.4.2009 09:53 #1

  • ElTwo

    Quote:Just be careful when using Malwareybytes software, as it has a habit of deleting system filesThat's not the definition of a "good choice."

    10.4.2009 21:09 #2

  • SProdigy

    Quote:Quote:Just be careful when using Malwareybytes software, as it has a habit of deleting system filesThat's not the definition of a "good choice."Yeah, but... sometimes Windows system files do become infected or are replaced with malware.

    Every AV product is known for having false positives (McAfee Enterprise had issues with previous versions of SpySweeper for example, deleting a necessary SS dll file.) Malwarebytes actually removes alot more junk; usually most people won't bother with crap like conficker and just format their machine, sometimes when it's unnecessary.

    11.4.2009 17:11 #3

© 2024 AfterDawn Oy

Hosted by
Powered by UpCloud