Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Possible Duplicate:
Conficker.Exe Removal

i have a windows XP sp 2 computer with windows XP sp2 on it. I have McAfee enterprise virusscan installed and recently i keep getting these popups.

alt text

it looks like the virus scan is detecting, cleaning, deleting, etc which is good but i continually get the same popups.

I ran microsoft malicious software removal tool and some other AV tools and noone detects anything.

any suggestions for how i get rid of this thing permamently. (besides reformatting and reinstalling to OS over again)

share|improve this question

marked as duplicate by Arjan, random Nov 18 '10 at 21:42

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

seriously dude...why don't you at least have SP3. epic fail – RobotHumans Nov 18 '10 at 21:06
up vote 3 down vote accepted

The conficker worm is highly annoying and difficult to remove because it tends to hide where it can't be found by scanning tools (System Restore cache), and duplicates itself all over your system. So your anti-virus tools end up finding the clones, but never the original. However, it is very possible to get rid of.

The last time I removed this worm, all I had to do was disable System Restore, which deletes all restore points (where the worm hides), downloaded and ran the latest release of Microsoft Malicious Software Removal Tool - which I repeated until it found nothing repeatedly. That was it. However, prior removals took a lot more effort.

This Microsoft article will tell you all about this annoying worm and how to remove it. The article also includes a link to a Windows patch that protects against this worm as well - once clean, make sure you apply this patch so this doesn't happen again.

If you are on a network, you'll also have to make sure that all other machines on the same network are also clean and patched as well. What your anti-virus is seeing could be the worm trying to spread to your machine and your anti-virus is catching it before it can infect your system. So your system may not be infected at all, while another machine on the network is and the worm is trying to spread from there.

share|improve this answer
+1 - In my experience, Microsoft's Malicious Software Removal Tool is the best way to get rid of Conficker. – user3463 Nov 18 '10 at 21:00
I'm surprised we don't have enough of these for a dedicated 'Conficker' tag...this one is a doozy. +1 for good info (and agreed with Randolph that MSMSRT is the sledgehammer best suited to this job) – Shinrai Nov 18 '10 at 21:29

First thing to do is disable system restore...slaving it into a known clean system as James suggests is a good idea as long as all autorun crap is disabled. The problem you run into there is if it's rootkitted, improper removal can make the PC not boot. I would look into "finding a copy" of the alohabob software migration software, removing you security software, doing the migration to a file store, format and reinstall, migrate back. I stopped tip-toeing around malware when the majority of the bad ones started implementing rootkit technologies.

share|improve this answer

Run a Spybot Search and Destory Scan. Take out the infected hard drive and scan it with a bunch of virus removal software from a known clean system. Make sure you have the latest antivirus updates for each product. Scanning a system with outdated antivirus definitions is of little use.

Basically follow the steps described here.

share|improve this answer
Spybot and Malwarebytes are currently ineffective against the Conficker worm. Unfortunately, there is a lot more to it than this. – Cypher Nov 18 '10 at 20:58

The tools mentioned will help but first thing to do is turn off system restore as mentioned. AND, check that it stays off after a reboot. I have seen one infection where something turned systemn restore back on on boot. The malware had some component that did this. A format was needed on that system. System restore off is critical to removing the malware

Symantec has a tool her ethat might assist as well Symantec Tool

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.