Article ID : S1Q0331 / Last Modified : 03/31/2009

Important information regarding the Conficker Worm Virus

Applicable Products and Categories of This Article

Any of the following symptoms may indicate your computer is infected with the Conficker worm, also known as Downadup, Kido or Conficker.B:

  • The McAfee® Web site, Symantec® Web site, or other security-related Web sites cannot be accessed.
  • Slow network connections.
  • Account lockout policies are activated.
  • Automatic Updates, Background Intelligent Transfer Service (BITS), Windows® Defender, and Error Reporting Services are disabled.
  • Domain controllers respond slowly to client requests.

Note: It is also possible your computer may be infected with this virus and not show any symptoms.

If a Conficker virus infection is suspected, the infected computer should be removed from the network. Most anti-virus software manufacturers have released free removal tools that can verify the presence of a Conficker infection and remove the worm. Here are links to some free removal tools:

Note: If you are unable to download the removal tool on the infected computer, download it using another computer and transfer it to the infected computer with a CD or USB drive.

More detailed information about the Conficker worm and manual removal instructions are available on the Microsoft web site in Microsoft KB Article ID 962007.