How to Remove and Avoid the Win32/Conficker Worm

Back in October Microsoft shocked us all by releasing an emergency security update to inform users about a vulnerability, known as MS08-067. The first type of malware to exploit this vulnerability was the TrojanSpy:Win32/Gimmiv.A. This Trojan quietly installed spy programs and or keylogger programs on computers in order to steal passwords and system information. The stolen information is then sent to a remote server where the perpetrator can utilize it for malicious activities.

Not long after the update was released came the emergence of new kind of malware called Win32/conficker.A. Through the exploitation of the Windows Server service vulnerability, this worm has the ability to infect computers across networks, basically allowing for remote code execution when file sharing is in use. Windows 2000, XP, Windows Server 2003 and any other version of the operating system with a “wormable exploit” were found to be vulnerable to this worm.

Then came the Win32/Conficker.B worm, like Conficker.A, it also has the ability to spread via network shares as well as removable drives. As a clear defense mechanism this worm is capable of disabling security services and obstructing a user's access to security related websites. This restriction opens the infected system to more attacks on top of preventing the system from downloading any new security software or receiving any updates for current security software. The worm also attempts to prevent its removal by using the access control list to fasten its executable onto the infected system.

Here are a few more symptoms you can look out for with regards to the Conficker worm:

If you  are experiencing any of these symptoms then the worn has probably got you, but not to worry there is a way out. Microsoft has developed a tool called the Malicious Software Removal Tool (MSRT) that they claim can remove the Win32/Conficker malware family. F-Secure developed the Malware Removal tool and Symantec developed the W32.Downadup Removal Tool to remove the same Conficker worm.

If you are not experiencing any of the above symptoms and you use Windows, here is some friendly advice on how to stay clear of the Conficker Worm:

1. First of all make sure your system has the most recent Windows updates, such as MS08-067, MS08-068 and MS09-001.
2. Ensure that you have a good security suite, an effective firewall is important.
   
3. Avoid "free" security scans that pop up on random websites, it could be a scam to further infect your system.
4. Use caution when opening attachments or links from unknown sources.
   
5. Turn the “autorun” feature off, it automatically runs programs found on memory sticks and USB devices.
6. Ensure that you utilize strong administrator passwords

Conficker has been spreading like wild fire resulting in researchers speculating on what the perpetrators ultimate goal might be. Having infected over 3.5 million computers researchers are wondering if Conficker might not be a botnet in the making.