confilcker virus

Checking and Cleaning WORM_DOWNAD or Conficker A/B/C


Basic Requirement:
1.      Latest Antivirus Signature and Widows patch (9586644) should be installed.
2.      Windows Xp with Service pack 2 and above
3.      Copy fixtool from   http://www.trendmicro.com/vinfo/virusencyclo/static/WORM_DOWNAD.A/WORM_DOWNAD_A-Solution.htm  fixtool into a CD



Actions Taken:

1.      Boot the system in SAFE MODE
2.      Disable System restore before Proceeding
3.      Open Regedit
4.      Go to HKLM\software\Microsoft\Windows NT\CurrentVersion\SvcHost
5.      Open netsvcs entry and search for the Services\Entries with Vague character at the bottom eg: wvkjbx, bffocbg,tdqmgg
6.      When searching for the same entries you should get the multiple entries but some of them are listed below
HKLM\system\currentcontrolset\enum\root\LEGACY-(Service name) with the DLL entry
7.      This DLL entry can be located at C:\windows\system32 folder (Will be hidden)
8.      Make a note of the SERVICE NAME and DLL File Name, so that the entries can be cross checked later.
9.      Extract the contents of the Fixtool into C:\Program Files\Trend Micro\OfficeScan Client\
10.      Click on Fixtool.bat to start the scan.

Boot the system into normal mode and check for the entry in registry and C:\windows\system32 folder that were removed using Fixtool.

11.      After booting the system in Safemode run MRT (fullscan)

Run the Malicious Software Removal tool
The Microsoft Malware Protection Center has updated the Malicious Software Removal tool (MSRT). This is a stand-alone binary that is useful in the removal of prevalent malicious software, and it can help remove the Win32/Conficker malware family.

Note The MSRT does not prevent reinfection because it is not a real-time antivirus program.

You can download the MSRT from either of the following Microsoft Web sites:
http://www.update.microsoft.com (http://www.update.microsoft.com)
http://support.microsoft.com/kb/890830 (http://support.microsoft.com/kb/890830)

For more information about specific deployment details for the MSRT, click the following article number to view the article in the Microsoft Knowledge Base:
891716  (http://support.microsoft.com/kb/891716/ ) Deployment of the Microsoft Windows Malicious Software Removal Tool in an enterprise environment
Note The Stand-Alone System Sweeper tool will also remove this infection. This tool is available as a component of the Microsoft Desktop Optimization Pack 6.0 or through Customer Service and Support. To obtain the Microsoft Desktop Optimization Pack, visit the following Microsoft Web site:
http://www.microsoft.com/windows/enterprise/technologies/mdop.aspx (http://www.microsoft.com/windows/enterprise/technologies/mdop.aspx)
If Windows Live OneCare or Microsoft Forefront Client Security is running on the system, these programs also block the threat before it is installed.