US-CERT - Conficker Worm

National Cyber Alert System - Cyber Security Alert SA09-088A
 

Conficker Worm Targets Microsoft Windows Systems

 
Original release date: March 29, 2009
Last revised: March 30, 2009
Source: US-CERT
 
Systems Affected
  • Microsoft Windows
Overview
US-CERT is aware of public reports indicating a widespread infection of the Conficker/Downadup worm, which can infect a Microsoft Windows system from a thumb drive, a network share, or directly across a corporate network, if the network servers are not patched with the MS08-067 patch from Microsoft.
 
Solution:
 
Instructions, support and more information on how to manually remove a Conficker/Downadup infection from a system have been published by major security vendors. Please see below for a few of those sites. Each of these vendors offers free tools that can verify the presence of a Conficker/Downadup infection and remove the worm:
 
Symantec:
Microsoft:
Microsoft PC Safety hotline at 1-866-PCSAFETY, for assistance.
 
US-CERT encourages users to prevent a Conficker/Downadup infection by ensuring all systems have up-to-date anti-virus software, the MS08-067 patch, and disable the AutoRun function in Windows: http://www.microsoft.com/technet/security/Bulletin/MS08-067.mspx
 
 
Description
Home users can apply a simple test for the presence of a Conficker/Downadup infection on their home computers. The presence of a Conficker/Downadup infection may be detected if a user is unable to surf to their security solution website or if they are unable to connect to the websites, by downloading detection/removal tools available free from those sites:
If a user is unable to reach any of these websites, it may indicate a Conficker/Downadup infection. The most recent variant of Conficker/Downadup interferes with queries for these sites, preventing a user from visiting them. If a Conficker/Downadup infection is suspected, the system or computer should be removed from the network or unplugged from the Internet - in the case for home users.
 
References
 
Microsoft Windows Malicious Software Removal Tool -
 
Microsoft Updates Website -
 
US-CERT Technical Cyber Security Alert TA09-088A -
 
Virus alert about the Win32/Conficker.B worm -
 
The Conficker Worm -
 
W32/Conficker.worm -
 
Microsoft Automatic Updates -
 
The most recent version of this document can be found at:
 
Revision History
March 29, 2009: Initial release
March 30, 2009: Included additional details