There are currently three variants of the virus, .A,.B, and .C.
Of the three .C is the hardest to inoculate, with .B being the most widespread.

How do I know if I’m infected with .B or .C?

It’s pretty simple. If you managed to download MS security patch and various scanners/cleaning utilities that don’t run when you open them (i.e., the open and close extremely quickly, processes being killed by the virus) and if you tried booting into Safe Mode but couldn’t then you most certainly have the .C variant of the virus lurking on your PC. If you’ve noticed this happen on your PC and are having a nightmare to remove it (the way I had) the proceed to the .C Clean and Removal Steps below.

.B is fairly simple to remove/clean. Therefore I’ll start with

.B Clean and Removal Steps
————————————-
(a) download the following four files
(1)- http: //iv.cs.uni-bonn.de/uploads/media/conficker_mem_killer.exe
(2)- http: //iv.cs.uni-bonn.de/uploads/media/regnfile_01.exe
(3)- http: //www.bdtools.net/download/bd_rem_tool.zip
(4)- http: //www.microsoft.com/technet/security/Bulletin/MS08-067.mspx
and download the appropriate MS-Hot Fix for your Operating System

(b) if you cannot get to one or any of the above links, stop your DNS Client Service

(c) boot the PC in Safe Mode

(d) run conficker_mem_killer.exe, then run regnfile_01.exe, then bd_rem_tool_console.exe (unzipped from the bd_rem_tool.zip files), and then finally patch the system with the appropriate MS-Hot Fix you downloaded.

(e) reboot in normal mode and re-run all those files except for the patch again

(f) Go to your Services and Start and set the following services to Automaitc
– Windows Update
– BITS
– Error Reporting
– Security Server (if applicable)
– Windows Firewall

(g) For extended protection, stop the Computer Browser service and set it to Disabled

(h) For extended protection, stop the Task Scheduler service and set it to Disabled

(i) For extended protection, stop the Server service (and any dependant services) and set it to Disabled (note that if your PC needs to share files or printers this service must be started and set to automatic)

(j) Enable your Windows Firewall and set the appropriate Exceptions you need (highly recommended)

(k) apply the latest Windows Service Pack and Fully Windows Update your PC (absolutely required)

(l) Set Windows Update to run daily and automatically update your PC
– open gpedit.msc (start>run and type in ‘gpedit.msc’) if you’re using XP SP2+ and go to Computer Configuration>Administrative Templates>Windows Components>Windows Update>No Auto Restart …. (Enable) so that after windows updates your PC automatically in the background it WILL NOT automatically restart the PC if there is a currently logged on user. (highly recommended)

(n) if you want to take furthere preventative measures disable autorun by going to gpedit.msc and go to
Computer Configuration>Administrative Templates>Windows Components>System>Turn Off Autoplay (Enable)

(o) Install the latest version of your Antivirus Software and make the virus definitions are fully updated and set to check and install updates daily. (highly recommended)

.C Clean and Removal Steps
————————————-
Do steps (a) and (b) as in the .B Removal Steps.

Now you just need to get your PC to boot into Safe.

To do so you need to get the Safe Mode registry keys from a like PC (O/S), export them from there and then import them on the infected PC.

This should allow you to boot into safe Mode on the infected PC.

Once you’re in safe Mode you can proceed with steps (c) onward without any problems.

The SafeMode keys you need to get are located in:
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot
Export the entire SafeBoot Hive (folder)

To import this file on the infected PC, simply double click on the .REG file you just exported.

The .C variant also prevents you from viewing hidden files on your PC.
The following Batch file should resolve this problem:

@ECHO OFF
BREAK ON
reg.exe add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL /v CheckedValue /t REG_DWORD /d 0×1 /f
pause
exit

Good Luck.

P.S.
For anyone who is boring with pop up messages from AV, disable admin and c shares on computer and it will stop. Scan and patch it and clear task scheduler.