win32.Conficker.A worm problem

We had major infection at our network since monday, but it is under control now. is our (painful :) experience:

1. To prevent further spreading, enable windows firewall on all machines, important thing is not to allow File and printer sharing because this is the way virus spreads. This could be difficult to do on file servers of course.
2. In or environment, desktops with XP SP3 and Vista SP1 were not infected but when attacked by broadcast from infected computers, they reported some svchost error. Patch did not help to prevent this.
3. Once you have firewall on, cliens should be able to work properly (even if they are infected). Problem was that servers, even patched, reported svchost errors when attacked by broadcast and several important services are then stopped (workstation, server, computer browser and so on).
4. Next step was to clean all desktops:
   1. Login as administrator
   2. Update antivirus.
   3. Show hidden and system files
   4. Scan Documents and settings\Network service, there should be infected file (s) with .jpg extension
   5. Go to Windows\System32 folder, find .dll file with same date and time (same second!) as kernel32.dll with 5-9 random letters, like woxqkl.dll or whatever, in my case size was 62976 bytes (there are few regular files with same size and maybe date, but they have sensible names, like iesetup.dll or dsauth.dll or something
   6. Open regedit, search HKLM, System, CurrentControlSet,Services for dll you found in step 5. Delete that folder (it will also have some random letters)
   7. Delete infected .dll from system32, you will have to use unlocker to delete it
   8. Apply Microsoft patch
   9. Scan Documents and settings\NetworkService and Windows\System32 again
   10. reboot
It takes all about 5 minutes, after that desktop should be safe.

If you have many many desktops, if you want to find infected ones (but they all probably are, if they had unpatched XP SP2), you can turn firewall logging on one of desktops and check log file for computers that are sending huge numbers of broadcast packets (ten in a row or something). Clean them first.

Good luck!

Thanks for your suggestions, but we spent two days trying to figure out what happened and based on your assumptions, everything is as you had written except for points 5. and 6. (there's a bunch of files created on the same date as kernel32.dll, but we can't find any of particular size and name,  only normal names dsauth.dll etc..and there's no registry entry ). Anyway, we stopped the spreading for a while, but the problem is not solved yet. Ina addition, the Hijack log file doesn't show anything that could lead to a worm problem, anyway I will post a log if it's needed...

Thank you very much for your help. Your painful experience helped us to have less painful solution.. Thank you once again (Hvala pobratime, piaem na engleskom zbog drugih !! )

ok simple solution, download  and burn to dvd knoppix 5.3 it is a linux version that boots up to dvd only . it does not install to your pc. it has a virus scanner in there so it does not boot up windows. it can clean up your virus 100% without any svchost reinstalling upon shutdown. so there you go, good luck and have fun.