Aliases: TA08-297A (other) CVE-2008-4250 (other) VU827267 (other) Win32/Conficker.A (CA) Mal/Conficker-A (Sophos) Trojan.Win32.Agent.bccs (Kaspersky) W32.Downadup.B (Symantec) Confickr (other)
Windows Defender detects and removes this threat.
This worm makes changes to you PC and can disable important system services and security products, like antimalware or antivirus software.
It spreads by infecting PCs on your network, removable drives (like USB flash drives), and weak passwords.
Microsoft strongly recommends that you:
- Apply the update referred to in Security Bulletin MS08-067 immediately
- Ensure that your network passwords are strong to prevent this worm from spreading via weak administrator passwords: Frequently asked questions about passwords
- Apply an update that changes the AutoRun functionality in Windows to prevent this worm from spreading via removable drives. More information is available in the Microsoft Knowledgebase Article KB971029
You should use the following free Microsoft software to detect and remove this threat:
- Windows Defender Antivirus for Windows 10 and Windows 8.1, or Microsoft Security Essentials for Windows 7 and Windows Vista
- Microsoft Safety Scanner
- Microsoft Windows Malicious Software Removal Tool
You should also run a full scan. A full scan might find other, hidden malware.
Additional recovery steps
You might not be able to connect to websites related to security applications and services that can help you remove this worm. For example, downloading antivirus updates might fail. In this case you will need to use an uninfected PC to download any appropriate updates or tools and then transfer these to the infected PC.
Microsoft Help and Support have provided a detailed guide to removing a Conficker infection from an infected PC, either manually or by using the Malicious Software Removal Tool (MSRT).
More information about deploying MSRT in an enterprise environment can be found here:
Get more help
You can also see our advanced troubleshooting page for more help.
If you’re using Windows XP, see our Windows XP end of support page.