How to Remove the Conficker Worm Virus

Conficker can damage your personal data if it's not stopped.

The Conficker computer worm was first spotted on the Internet in late 2008. Realizing the serious threat that this particular worm presented, computer professionals all over the world came together to help prevent the spread of Conficker. Thanks to the work of Microsoft, Symantec, and many others, the worm was mostly stopped in its tracks and was prevented from doing the widespread harm that the media had predicted. Although Conficker is no longer a major threat, there are still systems infected with the code--and if left unchecked, it can still do harm to your system and expose your personal data.

Difficulty:

Moderate

Instructions

Regain Access to Internet Security Sites

1. Click "Start," select the "Run..." option, type in "cmd" and press "Enter."

2. Type in "cd \" and press 'Enter" to navigate to the root directory of your hard drive.

3. Type in the following command (without the quotes) and then press "Enter":

   "net stop dnscache"

   This will prevent the Conficker worm from stopping your computer from visiting security sites where antivirus tools can be found.

Obtain Removal Tool

1. Download the virus removal tool to your computer from:

   http://www.symantec.com/content/en/us/global/removal_tool/threat_writeups/D.exe

   Save the file to your desktop for easy access.

2. Disconnect your PC from the network by unplugging the LAN cable from the back of your machine or by turning off your router, cable modem, or cellular tether.

3. Locate and run the "D.exe" file that you downloaded earlier by double-clicking the icon on your desktop. Click on the "Start" option and if necessary click on the "Allow" button to enable the removal tool to access system files as needed. Allow the program to run until completion.

4. Restart your computer and run the removal tool again once your computer has completely recovered to ensure that all instances of the Conficker worm have been removed, then restart your computer again.

5. Plug your network cable back into your PC or turn the power back on to your router, cable modem, or cellular tether to regain access to the Internet.

Tips & Warnings

• Keep your computer up-to-date with security patches from Microsoft to prevent future reinfections of Conficker and other viruses.

• Obtain an antivirus package to keep your computer safe from worms and viruses that take advantage of exploits that have not yet been fixed.

• While Conficker is active on your system, it will actively be attempting to spread itself to other machines. Keep your PC off the network until it is time to fix it, otherwise the infection might spread.

References

• Conficker Working Group: Main Page
• Norton: The Conficker Worm

Resources

• Microsoft: Protect Yourself from Conficker