Conficker (aka Downadup) – FAQ

What kind of damange can this virus do?

  • Create administrative accounts on your PC
  • Prevent you from downloading security and antivirus updates
  • Use your computer as part of a Denial of Service (D.O.S.) attack.
  • Could steal personal information
  • Populate your computer with malware pop-ups
  • Erase data on your computer

What computers are affected?

  • Unpatched Microsoft Windows operating systems (Microsoft Windows 2000, Windows XP, Vista, Windows Server 2003, and Windows Server 2008 systems)

What are some of the symptoms of being infected by the Conficker worm?

  • Windows Security Center will not work.  You can verify this by Start -> Control Panel -> Security Center
  • Account lockout policies are being tripped.
  • Automatic Updates, Background Intelligent Transfer Service (BITS), Windows Defender, and Error Reporting Services are disabled.
  • Domain controllers respond slowly to client requests.
  • The network is congested.
  • Various security-related Web sites cannot be accessed (Symantec, McAfee).
  • Disable commercial antivirus software
  • Turn off Microsoft’s security update service

How do I prevent infections?

  1. Patch your Windows operating system with the following patches:  MS08-067
  2. Install the latest security updates from Microsoft
  3. Make sure you are running up-to-date antivirus software and definitions from a trusted vendor (Mcafee, Symantec, Eset, Microsoft, etc…)
  4. Disable the AutoPlay feature through the registry or using Group Policies
  5. Exercise caution in what websites you visit
  6. Don’t open file attachments unless you have verified that you know the person who sent them and that they really meant to send the attachment.

How does the software spread?

  • Exploitation of the vulnerability that is patched by security update MS08-067 , MS08-068 a MS09-001
  • The use of network shares
  • The use of the AutoPlay functionality

How do I remove the worm from an infected computer?

  1. Disconnect the infected  computer from the network and the Internet.
  2. Install the patches below.  Use an uninfected computer to download the patch if necessary:  MS08-067 , MS08-068 a MS09-001
  3. Reset your system passwords to admin accounts using more sophisticated ones.
  4. Download and run the Conficker remover
  5. Reconnect your computer back to the network
  6. Update your antivirus application and definitions
  7. Install Microsoft updates

How do I protect my computer from similar threats?

  1. Enable Automatic Updates for your Windows computer
  2. Set your antivirus and definition update schedules to be more frequent (1 or 2 times a day)
  3. Exercise caution in what websites you visit
  4. Use caution when you see pop-ups on your screen (e.g. false virus notifications)
  5. Don’t open file attachments unless you have verified that you know the person who sent them and that they really meant to send the attachment.