W32/Conficker.worm Infection Cycle

The W32/Conficker.worm can infect systems via three infection vectors, via exploit MS08-067, an Autorun mechanism or by exploiting weak passwords. In addition the worm has an auto update routine to update previously infected systems .

These Infections are all multi stage processes. Involving the initial compromise,
copy files and then executing the malware.

Exploit Vector
Local network is scanned for susceptible computers. Once a susceptible computer is located the exploit is then attempted against the machine. If successful the process is hijacked and malware is copied from remote attacking machines HTTP server (random port # is used) to the localhost. At this point the machine is compromised.

How to remove Conficker and prevent re-infection

Symptoms of Conficker infection include the following:
- Access to security-related sites is blocked
- Users are locked out of the directory
- Traffic is sent through port 445 on non-Directory Service (DS) servers
- Access to admininistrator shared drives is denied
- Autorun.inf files are placed in the recycled directory, or trash bin

The following steps to remove W32/Conficker.worm and prevent it from spreading:

Uncover Svchost.exe worms

This tool to analyze Svchost.exe from our Computer, maybe it's a Trojans, Conficker or anything else, so i recomended install Svchost Process Analyze software. Download link below..

Svchost Process Analyzer lists all svchost instances and checks the services they contain. Svchost.exe is a generic host process name for Windows services that run from dynamic-link libraries (DLLs). The authentic svchost.exe is located in C:\Windows\System32, but numerous viruses and trojans use the same file and process name to hide their activities. Svchost Process Analyzer makes it easy to uncover Svchost worms like the infamous Conficker worm.

How To Fix A Svchost Exe Error

Do you get the Svchost.exe error? Want to know how to fix this? The Svchost.exe error is caused by viruses and worms.Svchost.exe, the core process of a system, usually only locates in the directory C:WindowsSystem32, and is not an infection process normally. However, due to the particularity of the Svchost.exe process, many viruses may do everything possible to compromise Svchost.exe. This error can cause serious damage to your computer and you should get rid of this problem as quick as possible.