Search Microsoft Security
Search Microsoft.com

Help protect yourself from the Conficker worm

Help protect yourself from the Conficker worm

Detections of the Conficker worm have increased by more than 225 percent since the beginning of 2009. As a result, we recommend that you double-check that your computer doesn’t have the worm.

Conficker is a computer worm that can infect your computer and spread itself to other computers across a network automatically, without human interaction.

If you are an IT professional, see Microsoft Security Intelligence Report: Conficker Remains a Threat.

On This Page

ETB

Is my computer infected with the Conficker worm?

Microsoft released a security update in October 2008 (MS08-067) to protect against Conficker.

If your computer is up to date with the latest security updates and your antivirus software is also up to date, you probably don't have the Conficker worm.

Double-check that your computer is up to date by using the following tools:

  • Run Windows Update and install updates.

  • Download Microsoft Safety Scanner and scan your system. Microsoft Safety Scanner is a free downloadable security tool that provides on-demand scanning and helps remove viruses, spyware, and other malicious software. It works with your existing antivirus software. It will expire 10 days after you download it.

  • Learn how Windows Defender Offline can help detect and remove malicious and unwanted software, including rootkits.

If you can't download the Microsoft Safety Scanner or Windows Defender Offline, contact support at 1-866-PCSAFETY or 1-866-727-2338. This phone number is for virus and other security-related support. It is available 24 hours a day for customers in the U.S. and Canada. For support in other countries, visit Worldwide Computer Security Information.

Back to top  ^

EWC

What does the Conficker worm do?

Here is a partial list of what Conficker can do:

  • Disable important system services and security products, such as Windows Defender, Microsoft Security Essentials, or Windows Update.

  • Download arbitrary files.

  • Prevent you from visiting websites, including those that allow you to download security updates.

More information about the dangers of the Conficker worm.

Back to top  ^

spread

How does the Conficker worm spread?

The Conficker worm spreads by copying itself to the Windows system folder. It might also spread through file sharing and through removable drives, such as USB drives (also known as thumb drives), especially those with weak passwords.

The worm adds a file to the removable drive so that when the drive is used, the AutoPlay dialog box will show one additional option.

In the following screenshot of the Autoplay dialog box, under Install or run program, the option Open folder to view files Publisher not specified was added by the worm. The option that is highlighted, Open folder to view files using Windows Explorer, is the option that Windows provides and the option you should use.

If you select Open folder to view files Publisher not specified, the worm runs and begins to spread itself to other computers.

Conficker worm in Autoplay

Back to top  ^

EKE

How does the Conficker worm work?

The following image shows how the Conficker worm works.

How the Conficker virus works

Back to top  ^

ETE

How do I remove the Conficker worm?

If your computer is infected with the Conficker worm, you might be unable to download certain virus protection security products, such as the Microsoft Malicious Software Removal Tool, or you might be unable to access certain websites, such as Microsoft Update. If you can't access those tools, try using Microsoft Safety Scanner to help remove viruses.

Detailed information about how to remove the Conficker worm.

If you can't download the Microsoft Safety Scanner or Windows Defender Offline, contact support at 1-866-PCSAFETY or 1-866-727-2338. This phone number is for virus and other security-related support. It is available 24 hours a day for customers in the U.S. and Canada. For support in other countries, visit Worldwide Computer security information.

Back to top  ^

EAF

Where can I find more technical information about the Conficker worm?

Back to top  ^