Manual steps to remove the Conficker.b variant

Do not log on to the system by using a Domain account, if it is possible. Especially, do not log on by using a Domain Admin account. The malware impersonates the logged on user and accesses network resources by using the logged on user credentials. This behavior allows the malware to spread.

The Server service should only be disabled temporarily while you clean up the malware in your environment. This is especially true on production servers because this step will affect network resource availability. As soon as the environment is cleaned up, the Server service can be re-enabled.

To stop the Server service, use the Services Microsoft Management Console (MMC). To do this, follow these steps:

1. Depending on your system, do the following:
* In Windows Vista and Windows Server 2008, click Start, type services.msc in the Start Search box, and then click services.msc in the Programs list.
* In Windows 2000, Windows XP, and Windows Server 2003, click Start, click Run, type services.msc, and then click OK.
2. Double-click Server.
3. Click Stop.
4. Select Disabled in the Startup type box.
5. Click Apply.

Remove all AT-created scheduled tasks. To do this, type AT /Delete /Yes at a command prompt.
Stop the Task Scheduler service.

* To stop the Task Scheduler service in Windows 2000, Windows XP, and Windows Server 2003, use the Services Microsoft Management Console (MMC) or the SC.exe utility.
* To stop the Task Scheduler service in Windows Vista or in Windows Server 2008, follow these steps.

For more about Manual Removal of Conficker visit on Virus Removal Center