Virus and Security Solution Center

Operation b49 and Operation b107

Operation b49 is a Microsoft-led initiative to take down a known botnet - Waledac - through industry collaboration and legal process. Operation b49 is just one action in a long term effort by Microsoft to combat cyber threats and advance the security of the Internet for everyone.


Operation b49 has been followed now by Operation b107, a similar legal and technical operation to take down the notorious Rustock botnet. These operations are part of a sustained effort by Microsoft known as Project MARS (Microsoft Active Response for Security) to disrupt botnets and begin to undo the damage the botnets have caused by helping victims regain control of their infected computers.


This webpage is dedicated to helping provide people with information on how to remove Waledac, Rustock or other malware from their computers, so the computers are no longer operating under the remote control of bot-herders.


Clean Your PC

If you believe your PC is infected with Waledac, Rustock or other malware, we recommend that you:


Protect your computer with Microsoft Security Essentials Software
For consumers needing protection from malicious software including Spyware, Viruses, Trojans and rootkits, Microsoft Security Essentials is the no-cost, high-quality anti-malware service that helps address the ongoing security needs of a genuine Windows-based PC.


Alternatively, you may:

  • Run the Microsoft Safety Scanner
    The Microsoft Safety Scanner is a free service that helps you check for and remove worms and viruses and improve PC performance.
  • Configure your PCs to help prevent security threats
    Building up your computer’s defenses helps secure your computer against viruses. To help prevent security threats from infecting your PC, the Malware Prevention Diagnostic Tool will guide you through configuring these system settings: set up automatic update for Windows, turn on Windows Firewall, enable Internet Explorer’s privacy settings, turn on User Account Control (UAC), clean your internet cache and browsing history, and more.

Protect your PC


To help prevent future malware infections, follow these steps to protect your computer: http://www.microsoft.com/security/pypc.aspx.


Get Help

If you need additional support click here: https://consumersecuritysupport.microsoft.com/default.aspx?mkt=en-us



Additional Information on Project MARS, Operation b49 and Operation b107


Initial Revelations and Results of the Rustock Takedown

Microsoft on the Issues Blog - Taking Down Botnets: Microsoft and the Rustock Botnet

Microsoft on the Issues Blog - Cracking Down on Botnets

MMPC Blog – What we know and learned from the Waledac takedown

The Official Microsoft Blog - R.I.P. Waledac: Undoing the damage of a botnet


Frequently Asked Questions


What is Operation b49 and Operation b107?
Operation b49 and Operation b107 are Microsoft-led initiatives to take down a known botnet - Waledac and Rustock, respectively - through industry collaboration and legal processes. Microsoft, working with industry and academic partners, conducted investigations into these botnets to identify its command and control servers - the driving force behind a botnet and the means by which a bot-herder controls their network – and sever their connections with the thousands of malware-infected computers working under their remote control. Microsoft has since begun to work with major Internet Service Providers (ISP) and Computer Emergency Response Teams (CERT) around the world to help victims remove the malware that enlisted their computers into the botnet.


Why is this important to me?
If your computer is infected with malicious software, your personal information may be at risk. Your computer may also be a part of a botnet, which is a network of compromised computers controlled by a remote attacker. Botnets are one of the most serious online threats due to their ability to engage in distributed denial of service attacks, as well as steal sensitive information, distribute malicious software, log keystrokes, and send spam. We urge you to follow the recommended actions on this site to minimize the risk to your computer and personal information.


How does Microsoft know which computers are infected with Waledac and Rustock?
Through Microsoft's recent legal action, Microsoft has notice of IP addresses of computers potentially compromised by the Waledac and Rustock botnets. We have worked with major Internet Service Providers (ISP) and Computer Emergency Response Teams (CERT) across the world to notify computer users who may be infected by Waledac and Rustock. That process may have led you to this page.

Virus information

Virus Information

Microsoft Consumer Online Safety
Protect your family, yourself and your computer by learning more about computer safety. The Consumer Online Safety web site provides useful tools and resources to get you up-to-date with PC safety and security.

Protect your computer with Microsoft Security Essentials software
With Microsoft Security Essentials, you get high-quality protection against viruses and spyware, including Trojans, worms and other malicious software. And best of all, there are no costs or annoying subscriptions to keep track of.

4 Steps to Protect Your Computer
Follow these four steps to keep your computer protected and up-to-date.

Think you have a virus? Follow these steps
This article discusses how to determine whether your computer is infected with a computer virus, worm or a Trojan, how to recover from an infection and how to prevent future infections from a computer virus.

Security information

Security Information

Diagnose and fix Windows security problems automatically
Automatically diagnose and fix problems with security in Windows, such as UAC (User Account Control), Windows Firewall or Data Execution Protection (DEP) to prevent security threats.

Security Checklist for Windows 7
Use this checklist to make sure you’re taking advantage of all the ways that Windows can help keep your computer as secure and safe as possible.

Install the latest Microsoft Security Patches
On the second Tuesday of each month Microsoft releases its latest security updates for its software. Ensure your computer is protected by installing the latest Security Bulletin from Microsoft.

Install Microsoft Updates
Protect your PC from security risks and ensure your version of Windows is up-to-date.

4 Steps to Protect Your Computer
Follow these four steps to keep your computer protected and up-to-date.

Microsoft Consumer Online Safety
Protect your family, yourself and your computer by learning more about computer safety. The Consumer Online Safety web site provides useful tools and resources to get you up-to-date with PC safety and security.

Protect your computer with Microsoft Security Essentials software
With Microsoft Security Essentials, you get high-quality protection against viruses and spyware, including Trojans, worms and other malicious software. And best of all, there are no costs or annoying subscriptions to keep track of.

Other security software providers

Microsoft wants to help ensure your PC is protected. If Windows Live OneCare and Microsoft Security Essentials do not meet your needs, learn more about other security software providers.

Windows 7 consumer security software providers

Windows Vista consumer security software providers

Windows XP consumer security software providers

Hoaxes and scams

Hoaxes and scams

Scams that use Microsoft’s name or product names
Phishing scams often include the names of well-known companies to convince you to visit spoofed Web sites or click on dangerous links. Microsoft does not send unsolicited e-mail requesting personal or financial information.

How to handle suspicious e-mail
Follow these guidelines to help protect yourself when suspicious mail shows up in your Inbox.

Scams that promise money, gifts, or prizes
Several types of phishing scams promise fantastic financial or other rewards in exchange for just a few small things you have to do…which include turning over your personal information to an identity thief.

How to recognize phishing e-mails or links
A few clues can help you spot fraudulent e-mail messages or links within them.

Frequently Asked Questions about Phishing
Find answers to the most popular questions about phishing.

How to Report Phishing
The Anti-Phishing Working Group is a volunteer organization that maintains a repository of phishing scam e-mails and websites. Report suspected phishing here.

Protect yourself from phishing scams and identity theft
Follow the steps on this page to protect your personal data such as credit card numbers, Windows Live IDs and passwords.

Ask the Community

Ask the Community

Security & Privacy forum at Microsoft Answers
Post questions in the Microsoft Security and Privacy Answers forum. Experts are on hand to help.


Getting Started with Microsoft Security Essentials forum at Microsoft Answers
Post questions in the Getting Started and Upgrading with Microsoft Security Essentials Answers forum. Experts are on hand to help.


Updating Virus and Spyware Definitions forum at Microsoft Answers
Post questions in the Updating Virus and Spyware Definitions for Microsoft Security Essentials Answers forum. Experts are on hand to help.


Scanning, Detecting and Removing Threats forum at Microsoft Answers
Post questions in the Scanning, Detecting and Removing Threats with Microsoft Security Essentials Answers forum. Experts are on hand to help.

IT Professionals

IT-Professional Security Resources

New Solution Accelerator: Microsoft Security Compliance Manager
Use the Microsoft Security Compliance Manager to provide centralized security baseline management features, a baseline portfolio, customization capabilities, and security baseline export flexibility to accelerate your organization’s ability to efficiently manage the security and compliance process for the most widely used Microsoft products.

Install the latest Microsoft Security Patches
On the second Tuesday of each month Microsoft releases its latest security updates for its software. Ensure your computer is protected by installing the latest Security Bulletin from Microsoft.

What’s New for Security in Windows Server 2008 R2
These product evaluation topics provide IT-Professionals with an overview of new and changed security related features in Windows Server 2008 R2.

Install Microsoft Updates
Protect your PC from security risks and ensure your version of Windows is up-to-date.

Microsoft Malware Protection Center
The Microsoft Malware Protection Center blog provides a real-time method for the Microsoft Malware Response Center to communicate with customers. Topics include day-to-day, “behind the scenes” information about new, emerging and interesting malware threats as well as other research topics in the computer security field.

Protect your Exchange messaging environment with Forefront Security for Exchange Server
Forefront Security for Exchange Server includes multiple scan engines from industry-leading security firms integrated in a single solution to help businesses protect their Exchange messaging environments from viruses, worms, and spam.

Security Checklist for Windows 7
Use this checklist to make sure you’re taking advantage of all the ways that Windows can help keep your computer as secure and safe as possible.

Stay secure: Visit the Security TechCenter on TechNet
The Security TechCenter provides links to technical bulletins, advisories, tools, prescriptive guidance, and community resources designed to help IT professionals keep Microsoft servers, desktops, and applications up to date and secure.

Assisted Support

Assisted Support


Contact Consumer Security Support
When creating a case, ensure that you provide all requested information related to the problem you are facing. In order to track and reference your inquiry, you will receive a support case number. This support case number will be required for all contacts with a Support Professional.
Hours: 24 hours a day, 7 days a week
Support Options

Assistance on other Microsoft Security Products
Microsoft Security Essentials
Windows Live OneCare

Javascript Disabled We detected that Javascript is disabled on your machine. To get the best support experience, enable Active Scripting

Last Review : April 11, 2012