Fix Conficker | Kido | DownUp | Downadup Worm

March 21, 2009 | By voidzzz | Filed in: How-To, Software, Tutorial, Windows, Windows 2003, Windows 2008, Windows Vista, Windows XP.

Here’s how to totally get rid of Net-Worm.Win32.Kido also known as :

  • conficker
  • kido
  • downup
  • downadup
  • Win32/Conficker.A
  • W32.Downadup
  • W32/Downadup.A
  • Conficker.A
  • Net-Worm.Win32.Kido.bt
  • W32/Conficker.worm
  • Win32.Worm.Downadup.Gen
  • w32.downup.c

This step by step will explain how to clean this worm includes all the variant.

  1. Download the following patches from microsoft :

    If you can’t download from the above link, use the following link :

  2. Download Kido Killer from Kaspersky or if you can’t download it from Kaspersky, use www.drivercabinet.com download
  3. For better results you’re suggested to disconnect from the network (disable your network or simply plug the network cable out)
  4. Run all the Microsoft patch above, when asked to restart, restart you computer
  5. Extract KidoKiller. Before you run kidokiller, this program from kaspersky got a few command switch that you can use such as :
    • -p [scan path] to scan specified folder
    • -f to scan all hard disks
    • -n to scan all network disks
    • -r to scan removable drives
    • -y to end program without pressing any key (program will automatically closed when the scan is done)
    • -s to run the program in silent mode, without command prompt window appears
    • -z to restore BITS Service, Windows Automatic Updates Service and Error Reporting Services
    • -x to restore display of hidden files (new variant will always set the hidden files and folder to hidden mode even you has change the settings, this switch fix it)
    • -a to disable auto start or auto run on all drives
    • -help to show information about the program (including all the switch and option available)

    Suggested use of switch :
    kkiller.exe -f -r -y -z -x -a

  6. When the scan finished, your system should be clear from Net-Worm.Win32.Kido also known as conficker, kido, downup, downadup.

    Update your antivirus to avoid future infection.


    Tags: , , , , , , , , , , , ,

    Leave a Reply

    Your email address will not be published. Required fields are marked *