Downadup/Conficker Worm Removal Tools

Conficker, also known as Downadup, Downup, and Kido, is a computer worm that appeared in October 2008 and that targets all major Windows operating systems. The worm exploits a previously patched vulnerability (MS08-067 exploit) in the Windows Server service in all versions of Windows, starting with 2000 and continuing up to Windows Server 2008 R2 and Windows 7 Beta. This virus is unusually difficult for network administrators to fight because of its combined use of advanced malware techniques.

One of the effects of this worm is a large number of account lockouts because it tries to log in to network shares with weak administrator passwords (dictionary-based brute force attack) to gain control over systems. The NetWrix Account Lockout Examiner tool can help to quickly identify lockouts, to unlock accounts, and to see what computer they are coming from.

Known Symptoms:

1) "The page cannot be displayed"; this message is displayed when you try to navigate to microsoft.com and some other Web sites, such as McAfee and Trendmicro, that can help with virus removal. This happens because the worm blocks some strings in DNS requests. However, this issue can be solved through use of a proxy server.
2) Unusually large numbers of invalid logons and account lockouts on many computers, because of brute-force attacks.
3) Hidden Autorun.inf is created on removable media and network drives (the worm tries to spread itself around).
4) Randomly named Windows service appears in the list of services (to start automatically during system boot).

Hotfixes

Use one of these URLs to download a fix (use a proxy server to download):

Account Lockouts

The Account Lockout Examiner tool helps to deal with some consequences of Conficker/Downadup propagation. The products tracks all account lockouts in real time so you can quickly identify infected machines, install required hotfixes as soon as possible, and unlock accounts in bulk with one mouse click. The tool also tries to identify some other common reasons for account lockouts so that you can separate worm-related lockouts from "normal" account lockouts (e.g., services and scheduled tasks using stale credentials). We provide a free 20-day trial of this tool for those who urgently need to deal with this virus. For more information, please visit the product information page.