Security Service Disable

Look For Disabled Services
Below are some services the worm disables, if any of these are disabled that you did not disable yourself – you could be infected:

 

wscsvc – Security Center
WinDefend Windows Defender (available in Vista)
wuauserv – Automatic Updates
BITS – Background Intelligent Transfer Service
ERSvc – Error Reporting Service
WerSvc – Windows Error Reporting Service (available in Vista)

Removed Restore Points
The worm removes all system restore points. If you have no system restore points, you may be infected.

 

Removal of Windows Security Center
If the following registry entry is missing, you could be infected: HKLM\Software\Microsoft\Windows\CurrentVersion\explorer\ShellServiceObjects\{FD6905CE-952F-41F1-9A6F-135D9C6622CC}

 

conficker 분석하다가.