Skip to main content
Skip to main content
Microsoft Security Intelligence
Cart 0 items in shopping cart
Sign in
Published Feb 25, 2009 | Updated Sep 15, 2017

Worm:Win32/Conficker.gen!B

Detected by Microsoft Defender Antivirus

Aliases: TA08-297A (other) CVE-2008-4250 (other) VU827267 (other) Win32/Conficker.worm.Gen (AhnLab) Win32.Worm.Downadup.Gen (BitDefender) Win32/Conficker (CA) W32/Conficker!Generic (Command) Net-Worm.Win32.Kido.fm (Kaspersky) W32/Conficker.worm.gen.a (McAfee) W32/Conficker.FL (Norman) W32/Conficker.C.worm (Panda) Mal/Conficker-A (Sophos) W32.Downadup.B (Symantec)

Summary

Worm:Win32/Conficker.gen!B is a generic detection for a worm that infects other computers across a network by exploiting a vulnerability in the Windows Server service (SVCHOST.EXE). If the vulnerability is successfully exploited, it could allow remote code execution when file sharing is enabled. It may also spread via removable drives, network shares and weak administrator passwords. It disables several important system services and security products.
 
Microsoft strongly recommends that users apply the update referred to in Security Bulletin MS08-067 immediately.
 
Microsoft also recommends that users ensure that their network passwords are strong to prevent this worm from spreading via weak administrator passwords. More information is available here.
 
Microsoft also recommends that users apply an update that changes the AutoPlay functionality in Windows to prevent this worm from spreading via removable drives. More information is available in the Microsoft Knowledgebase Article KB971029.
Microsoft strongly recommends that users apply the update referred to in Security Bulletin MS08-067 immediately.
 
Microsoft also recommends that users ensure that their network passwords are strong to prevent this worm from spreading via weak administrator passwords. More information is available here.
 
Microsoft also recommends that users apply an update that changes the AutoPlay functionality in Windows to prevent this worm from spreading via USB drives. More information is available in the Microsoft Knowledgebase Article KB971029.
 
To detect and remove this threat and other malicious software that may have been installed, run a full-system scan with an up-to-date antivirus product such as Microsoft Security Essentials. For more information about using antivirus software, see http://www.microsoft.com/security/antivirus/av.aspx.
 
Note: Computers infected by Conficker may be unable to connect to Web sites related to security applications and services that may otherwise assist in the removal of this worm (for example, downloading antivirus updates may fail). In this case users will need to use an uninfected computer in order to download any appropriate updates or tools and then transfer these to the infected computer.
 
Microsoft Help and Support have provided a detailed guide to removing a Conficker.B infection from an affected computer, either manually or by using the MSRT (Malicious Software Removal Tool).
 
For detailed instructions on how to manually remove Conficker.gen!B, view the following articles using an uninfected computer:
http://support.microsoft.com/kb/962007 - Virus alert for Win32/Conficker.gen!B and manual removal instructions
 
Additional information on deploying MSRT in an enterprise environment can be found here:
http://support.microsoft.com/kb/891716 - Deployment of MSRT in an enterprise environment
Follow us