How to combat the W32/Conficker worm


McAfee AntiSpyware Enterprise 8.x
McAfee Labs (AVERT)
McAfee Labs Stinger
McAfee SaaS Endpoint Protection 5.x
McAfee VirusScan Enterprise 8.x

W32/Conficker (all variants)
Top viruses and vulnerabilities in the wild


W32/Conficker is a worm with multiple variants. It exploits a buffer overflow vulnerability in the Server Service on Windows computers. McAfee Labs has named the most recently discovered variant of this worm W32/Conficker.worm.gen.d.

W32/Conficker is listed under Top Corporate User Malware in the Threat Library (

The original W32/Conficker.worm attacks port 445, the port that Microsoft Directory Service uses, and exploits Microsoft Windows vulnerability MS08-067. For instructions on how to download and apply the Microsoft Security Patch for this vulnerability, see Microsoft Security Bulletin

When the worm infects a system, it disables several critical security services including:

  • Windows Automatic Update
  • Windows Security Center
  • Windows Defender
  • Windows Error Reporting
The W32/Conficker worm attaches itself to several prominent Windows processes including:
  • svchost.exe
  • explorer.exe
  • services.exe
It also connects to a remote server for additional commands. It can receive instructions to propagate to other systems, gather personal information, or to download and install additional malware on the infected system.

See the Conficker- Note to Customers document attached to this article for more information and links to other resources.


IMPORTANT: See the Combating W32 Conficker worm document attached to this article for detailed information on detecting and removing the W32/Conficker.worm.

W32/Conficker.worm attack symptoms
  • Blocked access to security-related web sites
  • User lockouts
  • Traffic on port 445 on non-Directory Service servers
  • No access to admin shares
  • Autorun.inf files in recycled directory
  • When run, the worm copies itself using a random name to the %Sysdir% folder (where %Sysdir% is the Windows system folder, for example, C:\Windows\System32).
  • Some variants use these alternative file locations:

    %ProgramFiles\Internet Explorer
    %ProgramFiles\Movie Maker
    c:\documents and settings\all users\application data


Threat name Up-to-date Threat Library description Comments
W32/Conficker.worm.gen.c Triggered April 1, 2009
W32/Conficker, all variants List of all W32/Conficker virus variants

What to do next
  1. Download and apply the latest consolidated McAfee Labs Stinger tool from
  2. Use the Conficker Detection Tool available from
  3. Technical Support strongly recommends blocking the following URL* on your Internet gateway: hxxp://

    NOTE: This link has been formatted to avoid accidental infection. Therefore, replace hxxp with http and xxx (in fxxx4.exe) with uck
IMPORTANT: See the Combating W32 Conficker worm document attached to this article for detailed information on detecting and removing the W32/Conficker.worm.


3.6MB • < 1 minute @ broadband


Conficker- Note to Customers.pdf
86K • < 1 minute @ broadband

Glossary of Technical Terms

 Highlight Glossary Terms

Please take a moment to browse our Glossary of Technical Terms.