Since it’s release in late 2008, the conficker worm is believed to have infected over 10 million computers.

What are the symptoms?

Some of the most common symptoms are:

• Account lockout policies are automatically reset
• Windows services like Automatic Updates, Windows Defender, Error Reporting Service are disabled
• Local networks get congested
• It may restrict you from accessing security related websites (thus not allowing you to download removal tools)

How does it propagate?

• Through the exploitation of unpatched security vulnerabilities
• It spreads itself by using shared folders in local networks
• By using the autoplay feature in removable disks, such as memory cards and some USB devices

How to prevent an infection

• Use windows automatic updates to stay up to date with the latest patches
• Always use an active protection like an Antivirus and keep it updates, Antivirus companies release updates on daily basis. Avast! and AVG offer great free versions
• Run anti-malware tools like Spybot S&D or MalwareBytes every other week
• Don’t visit unsecured sites (this includes porn/warez sites) and watch out for what you are downloading, p2p networks can be highly dangerous if not used properly
• Stay away from “Free Web Scanners/Antiviruses”

How to remove conficker

Once a computer is infected, accessing removal tools may be complicated, if this is your case, download one of the tools listed below on a clean computer and copy it on a USB drive or CD, if possible run this tool in windows safe mode.

The best way to remove the conficker worm is by using a dedicated removal tool or by running an updated antivirus.

Here are some standalone removal tools that you can use to remove conficker (free):

• Symantec’s Conficker (aka Downadup) tool
• BitDefender’s Anti-Downadup
• Sophos Conficker removal tool
• Trend Micro’s Cleanup Engine

Are you having a hard time removing the Conficker worm? post a comment and we will help you.

Spybot screenshot

Spybot S&D offers a very easy and intuitive UI (user interface), that after following a few simple steps can help you get rid of the unwanted software.

Download

We have a link to this application in our “tools” page, but you can also obtain the latest release from the original Spybot S&D website: www.safer-networking.org

1. Select your location by choosing your language/location flag.
2. Click on the “Download” link, located on the top right side.
3. Scroll down until you reach the downloads section and click on the download cube icon.
4. Now you have to select a file server from where to download it, the main mirrors are usually the best option, keep in mind that when you click on the “download here” link, this will redirect you to the website that is actually hosting the file, some of those websites have confusing advertising, so make sure you select the right download button.

Be aware of deceiving download links

Installation

The installation process is a very intuitive one, after you’ve downloaded the installation file, run it and follow the simple steps. My recommendation is that less advanced users disable the permanent protection option called “TeaTimer”, not because is a bad tool, actually it’s a very good one, but because it’s there to alert and prevent changes in the windows registry, which may confuse and annoy the common user.

Noobie users may want to disable the TeaTimer option

First Use

After you install Spybot, a wizard will prompt you to define some simple setting and it will ask you to update it’s database of definitions, it’s very important to keep anti-malware software updated. This wizard will also prompt you to “immunize” your system, immunization protects your computer against some types of spyware and malicious websites that promote them.

Performing a system scan

It’s important to understand that Spybot is not a resident application, this means that it doesn’t protect your computer at all times, but instead it’s a standalone application that you will have to run often, my experience tells me that running Spybot every couple weeks is a good procedure (of course you must have a resident antivirus application running at all times). To scan your system follow this steps:

1. Open Spybot
2. Update it by clicking “Search for Updates” and download all necessary updates. (skip if you recently did this)
3. Start the scan by clicking on the “Check for problems” button
4. Spybot will prompt you to delete the temporary files, click yes
5. You will now see at the bottom of the application, a filling green bar moving toward the right, this indicated scanning activity and progress, the amount of time it takes to complete this task depends on your system specs
6. Now that it has finished scanning, Spybot will select all problems by default, items marked in red indicate a real threat and items colored in blue indicate tracking usage. In the case that Spybot has found a malicious piece of software, you need to get rid of it, to do that, make sure you have items selected and click on the button labeled “Fix selected problems”, in some cases it can take several minutes to remove all the threats so you have to wait for the success message.
7. If there still are malicious traces, running Spybot in Windows Safe Mode is highly recommended.

And that’s basically it, remember to always update and run Spybot as often as possible.