How to Remove W32 Conficker Worm

The W32 Conficker worm can infect entire networks.

The W32 Conficker worm virus is also known as "Worm:W32/Downadup.gen," "Worm:W32/Downadup.gen!A," according to F-Secure. Microsoft reports that the W32 Conficker worm propagates by exploiting certain vulnerabilities in Svchost.exe, as well as through AutoPlay and network sharing. Symptoms of W32 Conficker infection include blocked antivirus programs, the inability to access antivirus product websites or online services and account lockouts due to changes in the registry. This virus carries a "Severe" threat alert; remove it as soon as possible.

Instructions

MSRT

1. Download the Microsoft Malicious Software Removal Tool for removing the W32 Conficker worm (see Resources). Disconnect your computer from the Internet.

2. Right click "Computer" in the Start menu and select "Properties" from the pop-up menu. Click on the "System Restore" tab at the top. Check the box next to "Turn off System Restore on all drives" in the System Restore settings. Continue through any prompts and wait for System Restore to turn off.

3. Locate the MSRT download and double-click it to begin the removal process. Click "Next" and select "Full Scan." Wait for the scans to complete.

4. Read the results of the scans. If the MSRT found the W32 Conficker worm on your computer, it should have removed it. Close the MSRT.

5. Reboot your computer. Open the System Restore properties again and uncheck the box next to "Turn off System Restore on all drives." Close the System Properties window. Reconnect your computer to the Internet.

Symantec Removal Tool

1. Download the Symantec removal tool for the W32 Conficker worm (see Resources). Disconnect your computer from the Internet.

2. Right click "Computer" in the Start menu and select "Properties" from the pop-up menu. Click on the "System Restore" tab at the top. Check the box next to "Turn off System Restore on all drives" in the System Restore settings. Continue through any prompts and wait for System Restore to turn off.

3. Locate the downloaded Symantec removal tool and double-click it to launch the program. Accept the user agreement and click "Start." Wait for the scan to complete.

4. Read the result of the scans. If the removal tool finds the W32 Conficker worm, it will remove it. Close the removal tool.

5. Reboot your computer. Open the System Restore properties again and uncheck the box next to "Turn off System Restore on all drives." Close the System Properties window. Reconnect your computer to the Internet.

F-Secure Removal Tool

1. Download the F-Downadup removal tool from the F-Secure website (see Resources). Disconnect your computer from the Internet.

2. Right click "Computer" in your Start menu and select "Properties" from the pop-up menu. Click on the "System Restore" tab at the top. Check the box next to "Turn off System Restore on all drives" in the System Restore settings. Continue through any prompts and wait for System Restore to turn off.

3. Double-click the F-Secure removal tool. The program will start automatically. Wait for the scans to complete.

4. Reboot the computer as directed by the F-Secure removal tool. If the program does not find the W32 Conficker worm, it will close automatically.

5. Open the System Restore properties again and uncheck the box next to "Turn off System Restore on all drives." Close the System Properties window. Reconnect your computer to the Internet.

Tips & Warnings

• Keep your computer up to date to help prevent infection by the W32 Conficker worm.

References

• Microsoft Support: Virus Alert About the Win32/Conficker Worm
• F-Secure: Worm: W32/Downadup.gen
• Microsoft Malware Protection Center: Win32/Conficker

Resources

• Microsoft Download Center: Microsoft Windows Malicious Software Removal Tool
• Symantec: W32.Downadup Removal Tool
• F-Secure: Downadup Removal Tool