How to Remove Conficker virus

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

oh, as far as running on all the computers at once from a central server, this is not really feasible as you really want to be scanning memory and low-level system files as well seeing as you are already infected. I know it's very time consuming but thats the way it goes sometimes! next time hopefully you are better protected.

Louis LIETAER

try this
http://cantalktech.com/2009/01/21/how-to-remove-downadup-conficker-virus/

just one more comment; before you run these removal tools, disable System Restore, to keep the worm from reinstalling on reboot. Run the tools again, before re-enabling System Restore, just as a precaution.

SOLUTION

samithsukumar

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

ASKER

Hi Vague hit

Thanks for your reply. I understand it is too late to regret, we had AVG but this virus could have been spread through USB stick. What is my concern is even though we have so many removal tools for different version of conficker, will the above tool you mentioned remove the conficker completely?

after spending so much time, we don't want to get infected again.. so just want be sure the above symantec and malware tools remove this completely..

The above tools can be run on windwso sever 2003 as well, right? As you mentioned we will be running PC by pc and sever by server.. on Monday.

OriNetworks

If you keep your computer up to date using windows update you should be able to just go to Start->Run and type in mrt.exe and press ok. This will launch Microsofts Malicious Software Removal Tool and should remove the problem.

ASKER

Hi all

I need some help on how to run remover tools on Exchange and DC server (running on one server). I read some article on excluding the mdb and .stm files...

Incase if I want to run this, Can I stop the IIS and Exchange information store and run this? at the moment exchange DB is on D drive. OR I just stop only IIS and run the scan on C drive?

Louis LIETAER

At boot time press F8 and run windows in safe mode

hi there, yes the tool can be run on windows server 2003 and is for ALL versions of the conficker virus. also, malwarebytes finds and removes all instances of the virus as well. with the combination of both tools (be sure to allow malwarebytes to update when you run it too) it should eliminate all trace

SOLUTION

OriNetworks

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

ASKER

Hi all

We are doing the cleanups and will update you once we completed everything.

warturtle

The below question might be helpful:

https://www.experts-exchange.com/questions/24268820/April-1st-Virus.html

SOLUTION

xmachine

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

SOLUTION

dt3itsteam

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

ASKER

Thanks all for your input.

We fixed the issue by running

1. Mcafee Stinger tool
2. Anti malware bytes and
3. updated AVG is installed
(System restore was disabled as well)
------------------------------------------
CB- We have done some research about the AV tools and AVG was the better option.. and we bought it as well. so need to stay with them until the contract runs out.