Conflicker has been beating us down all week. We think a server or workstation is clean, but it comes back.

Windows Updates are up-to-date and everyone runs Trend or NOD32.

It would be great to use an effective tool to help us clean the computers. We are still experiencing workstation and/or server services shutting down, random tasks are added to the Scheduler, failing Automatic Update service, and DNS poisoning (I think that's what it's called when you suddenly can't get to microsoft.com and its related update sites).

So far we have used Windows Malicious Software Removal Tool (6/2009), and BitDefender Removal Tool. Neither seems terribly effective.

  • 3
    Take away "Administrator" rights from your users or you're never going to end the battle. Today it's "conficker", tomorrow it will be something else. Clean the slate by wiping and reloading the messed-up machines, and stop giving out "Administrator" rights. If someone "needs" to have "Administrator" rights to run a program you're not trying hard enough. Jun 30, 2009 at 22:12
  • The users don't have local admin rights, but I suspect laptop users (mostly managers or attorneys do). Jun 30, 2009 at 23:45

5 Answers 5


The issue seems to be not that the things you have tried haven't worked, it seems more likely that, after you have cleaned one machine, another infected machine on the network will infect the machine you have just cleaned. You need to do a complete clean of all systems on the network. During that time, you will have to keep the machines from re-infecting one another.

Microsoft does have a knowledge base about this, Here. If the things there don't work, you will have disconnect every machine from the network, disinfect every machine, and then hook everything back up again. Good luck.


There is only one effective method to clean a compromised workstation\server\network, and that is to wipe the machine(s), reinstall Windows and restore your data. Any other method, and you will never be sure that someone else doesn't own your network.

Once you're back up and running, the most effective ways to protect your network are, in order of importance/effectiveness:

  1. Not giving users local administrator rights on their Workstations.
  2. Enforce a strong password policy
  3. Use Group Policy to manage Internet Explorer and XP Firewall on Workstations.
  4. WSUS for updates for Servers and Workstations
  5. Anti-Virus
  • 1
    This is true. Malware hides in so many places and infects so many files that even a removal tool isnt trustworthy, especially for an important machine. You can never be sure. Format and reinstall.
    – cop1152
    Jun 30, 2009 at 22:05
  • 1
    Evan says: serverfault.com/questions/27708/… Jun 30, 2009 at 22:10
  • 1
    Worth a mention: The Conficker Eye Chart. confickerworkinggroup.org/infection_test/cfeyechart.html
    – Qwerty
    Jun 30, 2009 at 23:44
  • That's not necessarily an option, speaking of critical infrastructures and high availability systems. And yes, these days they run WinDos. ;)
    – wishi
    Jul 1, 2009 at 12:01

The reason it spreads is because you have not yet set the group policy as specified here. Then you can clean the machines using the Malicious Software Removal tool. While many times you do need to wipe the machine, this is not one of them (as long as this is the only issue you have). Hopefully you have also initiated some sort of WSUS or another mandatory patch management solution.


Symantec offers a removal tool along with instructions on how to quarantine while disinfecting. McAfee does also, but they call it S.T.I.N.G.E.R.
Take down the network while cleaning if you can, that will keep computers from getting re-infected.


There's the Confickr working group and the Unfickr project. I pretty much guess you'll find all infos there. I would recommend to go through propper Nmap checks at first on the whole available subnet.

System hardening, working in user mode, using app policies - priceless nowadays.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .