Conficker – Downadup Worm Removal

This post was written by admin on February 3, 2009
Posted Under: Conficker, Free PC Security

Update May: Click here for Free Conficker Removal Tool for PC’s and Networks

Conficker, also known as Downadup, Downadup.AL, Win32.Kido is a standalone malicious worm that blocks access to many security websites making it more difficult for users to update their security software.

It may also redirect users to other legitimate sites so that the creators of this worm can identify the IP Address of infected computers, although the reasons behind this are unclear at the present time.

Users who have regularly updated their security software and installed the released patches from Microsoft are reasonably safe from this particular worm, BUT, there are believed to be around 9 million computers infected and this is believed to be increasing by up to 1 million per day.

This worm also spreads through external media such as removable usb drives and usb flash drives, therefore users who are infected must ensure that they do not plug in external devices, and if users do then autorun should be disabled and read-only mode enabled.

There are some dedicated removal tools to eradicate this worm from users computers and it is essential to TURN OFF System Restore to stop the worm from resurfacing.

BitDefender have released dedicated removal tool that will remove the early variations and the newer version that is circulating.

Download BitDefender Conficker Remover here

Emsisoft a-squared free will detect and remove Conficker from infected computers and flash drives.

This is a very simple to use program, simply download, install update and click Scan PC. If you have external drives or flash drives that you want to scan click the 'Custom' radio button and select 'Add folder' and the Browse window will open so that you can add external devices.

Then click 'Next' and leave it to scan.

There is also a-squared Emergency USB Stick files which contains a-squared free and a-squared Commandline scanners.

Simply download the zip file and extract it to a USB stick and you can then run it on any computer.

Download a-squared free here
Download USB Stick version here

Both versions are free and will run on WinXP/Vista/2003 Server/2008 Server with limited functionality for 64bit machines.

Symantec Removal Tool.
Download the FixDownadup.exe file and save it to your Desktop or a folder that you have specifically for downloads.

Close all open programs, disconnect from the internet and turn off System Restore.
Double click the FixDownadup.exe to start the removal tool, accept the agreement then click Start and allow the tool to run.

When the tool has finished running a message will be displayed showing whether the infection was found on the users computer, the number of scanned files, deleted files, repaired files terminated processes and fixed registry entries.

If any infections are found and removed users should reboot and run the tool again to ensure that their system is clean, then re-enable System Restore, reconnect to the internet and update your security software.

Should users encounter any problems running the tool it is advised to reboot into Safe Mode.

Download Conficker / Downadup Removal tool here

Windows Malicious Software Removal Tool
32bit users Download Microsoft MSRT here
64bit users Download Microsoft MSRT here

F-Secure Removal Tool:
This uses a Command Line Scanner which is more suited to users who are comfortable using the Command Line.
Download and full details of F-Secure Downadup Removal Tool click here

More information including a list of blocked security sites and a list of computer login passwords can be found here on F-Secure's information page.

Please ensure that ALL Windows patches are applied through Windows update, and run the Malicious Software Removal tool.

To run the tool, go to Start > Run, type mrt and press enter.

Related articles:
Conficker C - Includes new tools for removal of Conficker A and B
Malware Redirects Browser or Blocks Internet Connectivity
Trojan and Worm Remover