For the last day I have been struggling with Removing the Conficker worm from computers at my place of employment. The worm is very clever which makes it harder to eliminate.
Symptoms
* Cannot run Windows Update
* Cannot Update Antivirus Software
* Cannot start up in Safe Mode
* Inability to view many websites
The worm keeps you from going to sites to try to get rid of it, and instead occasionally will redirect you to sites that Have more malicious files.
Checking for the worm
So, Do you have the worm? Lets check. Go to http://www.confickerworkinggroup.org/infection_test/cfeyechart.html In Internet Explorer.
If the page loads, your on to a good start. There are 6 images displayed on the page right at the top. If some of them load, yet others don't, you probably have a variant of the Conficker worm. If they all load successfully, you are most likely alright. It should look like the below picture if everything loaded correctly
Removal
So if you do have issues viewing the site, or Microsoft update, here is the EASIEST way to remove it.
If you have access to a second computer, Utilize that computer to download the two following files. First, download this file http://iv.cs.uni-bonn.de/uploads/media/conficker_mem_killer.exe
This file is a memory killer which will immediately kill the conficker worm if it is running. BEFORE RUNNING however, you must rename the file so it does not contain the word "conficker". You can easily toss a letter or 2 in the name to get it to work. Run the file. It will flash a command prompt quickly that should go through and terminate all running conficker process's.
Next
The next step is to download and run the fixdwndup tool from Symantec located here http://www.symantec.com/business/security_response/writeup.jsp?docid=2009-011316-0247-99 Once you have obtained it, run the program and it will find the infection and clean it. Immediately reboot your computer and perform a windows update, as well as update all anti-virus software you have, and run regular scans. During the time your computer was infected, you MAY have contracted other worms and virus's.
If you have ANY Questions, comments, or concerns, feel free to post below and I will answer them! Best of luck!
Also, If you liked this site, Check out the Rest of my Links, Learn about my GPT (Get Paid To) experience through www.Cashcrate.com And see how YOU can Make Money online with out paying a dime!
Thursday, April 2, 2009
How to Detect and Remove the Conficker or Downadup Worm from your Computer
Subscribe to:
Post Comments (Atom)
Posts
Great Information waldo! Thanks! I new I was safe already but to those who don't really know what htey are doing, this post is Grade A+
ReplyDeleteKeep up the good work!
Much thanks for the comment. Staying safe using preventative measures like Windows Update, Antivirus Updates, and safe browsing habbits is the way to go!
ReplyDeleteInteresting, a feature supposed to prevent removing the worm helps detecting it.
ReplyDeleteMuch thanks lr5, It is pretty cool that the virus writers made it so easy to detect with out knowing it!
ReplyDeleteGlad I found your blog. I had been meaning to look into this. Very helpful info. Thanks!
ReplyDeleteHope it helps! *actually I hope you don't have the worm, since its new variants have purportedly been installing key loggers that can steal personal data*
ReplyDelete