CONFICKER WORM

The Conficker worm is a computer worm that can infect your computer and spread itself to other computers across a network automatically, without human interaction.

If you are an IT professional, please visit Conficker Worm: Help Protect Windows from Conficker.

On This Page

Is my computer infected with the Conficker worm? Is my computer infected with the Conficker worm?

What does the Conficker worm do? What does the Conficker worm do?

How does the Conficker worm work? How does the Conficker worm work?

How do I remove the Conficker worm? How do I remove the Conficker worm?

Where can I find more technical information about the Conficker worm and how can I stay up to date on the Conficker worm? Where can I find more technical information about the Conficker worm and how can I stay up to date on the Conficker worm?

Is my computer infected with the Conficker worm?

Probably not. Microsoft released a security update in October 2008 (MS08-067) to protect against Conficker.

If your computer is up-to-date with the latest security updates and your antivirus software is also up-to-date, you probably don’t have the Conficker worm.

If you are still worried about Conficker, follow these steps:

  1. Go to http://update.microsoft.com/microsoftupdate to verify your settings and check for updates.
  2. If you can’t access http://update.microsoft.com/microsoftupdate, go to http://safety.live.com and scan your system.
  3. If you can’t go to http://safety.live.com, contact support at 1-866-PCSafety or 1-866-727-2338. This phone number is for virus and other security-related support. It is available 24 hours a day for the U.S. and Canada. For support in other countries, visit the Worldwide computer security information page.

Back to Top

What does the Conficker worm do?

To date, security researchers have discovered the following variants of the worm in the wild.

Win32/Conficker.B might spread through file sharing and via removable drives, such as USB drives (also known as thumb drives). The worm adds a file to the removable drive so that when the drive is used, the AutoPlay dialog box will show one additional option.

The Conficker worm can also disable important services on your computer.

In the screenshot of the Autoplay dialog box below, the option Open folder to view files — Publisher not specified was added by the worm. The highlighted option — Open folder to view files — using Windows Explorer is the option that Windows provides and the option you should use.

If you select the first option, the worm executes and can begin to spread itself to other computers.

 The option Open folder to view files — Publisher not specified was added by the worm.

The option Open folder to view files — Publisher not specified was added by the worm.

Back to Top

How does the Conficker worm work?

Here’s an illustration of how the Conficker worm works.

 Here's a visual explanation of how the Conficker worm works. Back to Top

How do I remove the Conficker worm?

If your computer is infected with the Conficker worm, you may be unable to download certain security products, such as the Microsoft Malicious Software Removal Tool or you may be unable to access certain Web sites, such as Microsoft Update. If you can’t access those tools, try using the Windows Live safety scanner.

Back to Top

Where can I find more technical information about the Conficker worm and how can I stay up to date on the Conficker worm?

For more information, see How to prevent computer worms and How to remove computer worms.

Entertop.net – Support Index