03/30/2009

Defeating & Removing Conficker

Kevin R. Smith
Co-Editor

"What we've found is pretty cool: Conficker actually changes what Windows looks like on the network, and this change can be detected remotely, anonymously, and very, very quickly. You can literally ask a server if it's infected with Conficker, and it will tell you."

So says security researcher Dan Kaminsky in his blog about detecting and removing Conficker (also called Downandup).

What this means is there may be a way for computer users and network administrators to both detect and patch systems and also block further infection of other computers from their computers.

This is really the first news of a possible crack in Conficker's armor and definitely good news.

When a virus, trojan, or other malware hits mainstream news, it's something to watch out for, and if you haven' t heard anything about this worm yet, here's some info from the official Conficker Work Group and their FAQs that will help anyone who's asking, "What is Conficker?" learn more about it.

Removing Conficker / Downandup

Thanks to PCMag.com for a great list, included below, of several resources and tools for detecting, removing, and uninstalling Conficker / Downandup if you've reason to believe your computer (or that of a friend or colleague may have been infected).

McAfee Stinger

ESet EConfickerRemover

Symantec W32.Downadup Removal Tool

F-Secure F-Downadup, FSMRT, more tools

BitDefender single PC and network removal tools

Kaspersky KKiller

Trend Micro

If you use one of these tools to remove Conficker immediately install the MS08-067 patch afterwards.

BitDefender

Symantec