Need conficker virus help

[RedRalph]

I got the conficker virus (the big one form late last year) and need help getting rid of it. I know microsoft has a tool to get rid of it, I know theres loads of blogs out there that tell you how, etc etc but the beauty of this *&6%ing virus is that it wont let me access the microsoft (or any other) programme, and wont let me into any web pages that tell how to get rid of it. If someone, anyone, would oblige and C&P (please dont bother posting a link as I wont be able to open it) instructions on how to get rid I would be wildly grateful. Please.

 

[Turner]

From this site.

If your computer does not have an up-to-date antivirus solution, or does not have an antivirus solution at all, you can either use a special removal tool (which can be found here or follow the instructions below:
More details about the vulnerability can be found here:
http://www.kaspersky.ru/support/wks6mp3/error?qid=208636215

Or follow the instructions below:

1. Delete the following system registrykey:
[HKLM\SYSTEM\CurrentControlSet\Services\netsvcs]
2. Delete &#8220;%System%\<rnd>.dll&#8221; from the system registry key value shown below:
[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SvcHost]
"netsvcs"
3. Revert the following registry key values:
[HKCR\ Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"Hidden" = "dword: 0x00000002"
"SuperHidden" = "dword: 0x00000000"

to
[HKCR\ Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"Hidden" = "dword: 0x00000001"
"SuperHidden" = "dword: 0x00000001"
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL]
"CheckedValue" = "dword: 0x00000000"

to
[HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL]
"CheckedValue" = "dword: 0x00000001"
4. Reboot the computer.
5. Delete the original worm file (the location will depend on how the program originally penetrated the victim machine).
6. Delete copies of the worm:

%System%\<rnd>dir.dll
%Program Files%\Internet Explorer\<rnd&gt.dll
%Program Files%\Movie Maker\<rnd>.dll
%All Users Application Data%\<rnd>.dll
%Temp%\<rnd>.dll
%System%\<rnd>tmp
%Temp%\<rnd>.tmp

<rnd> is a random string of symbols.
7. Delete the files shown below from all removable storage media:
<X>:\autorun.inf
<X>:\RECYCLER\S-<%d%>-<%d%>-%d%>-%d%>-%d%>-%d%>-
%d%>\<rnd>.vmx,
8. Download and install updates for the operating system:
http://www.microsoft.com/technet/security/Bulletin/MS08-067.mspx
9. Update your antivirus databases and perform a full scan of the computer (download a trial version of Kaspersky Anti-Virus).

 

[RedRalph]

Thanks Turner. Anyone else got it and successfully removed it?

 

[J-man]

Keep, your windos up to date. Hasn't there been a patch for ages?

 

[RedRalph]

Well apparently there was, and I assumed it was one of the ones I had downloaded over the past months, but then I remembered there was one that repeatedly failed to install so I just cancelled it... more fool me

 

[aimeeandbeatles]

Did you check the HOSTS file? if you can't access sites, you might be able to get to them if you edit it

 

[RedRalph]

Did you check the HOSTS file? if you can't access sites, you might be able to get to them if you edit it

sigh... I really do appreciate the attempt to help, but I have no idea what that means.

 

[aimeeandbeatles]

http://en.wikipedia.org/wiki/Hosts_file#Default_content_on_Windows_operating_systems

Default content on Windows operating systems

In Windows, the default hosts file is often blank or it contains (inactive) comment lines followed by IPv4 or IPv6 localhost entries.

On systems with default configurations the full path to this file is C:\WINDOWS\System32\drivers\etc\hosts.

127.0.0.1       localhost
::1             localhost

so I'd compare yours to the one on wikipedia. I've read somewhere that if viruses block or redirect sites, its often in the HOSTS file.

 

[RedRalph]

OK thanks Aimee, I'll give it a try

 

[RedRalph]

Arrtgh!!!!! I used a Dutch program called hitman Pro to get rid of the virus, and in the proccess it hasd destroyed my PC. for some reason, I cannot connect to the net, and all other accounts except mine are innaccesible. they havent been deleted, because when I go into 'users' in control panel they are there but there is no way to access them (I'm using XP, and the usual screen on startup where it asks which user I want to log on to is gone). any ideas?

 

[aimeeandbeatles]

Pop in a Knoppix disc, backup all files you wanna keep, and reinstall Windows.

 

[Bratmon]

Pop in a Knoppix disc, backup all files you wanna keep, and reinstall Windows.

That solution could replace this entire forum.