Can ILOVEYOU, Mydoom, Conficker or Stuxnet Infect Windows 10 and 11 Today?

Short version: the original exploits are mostly closed. The names are still used as bait, and old, unpatched machines are still the weak spot.

Virus, worm or Trojan: why the label matters​

All four are technically worms. They copied themselves between computers instead of only infecting files on one machine. Everyday speech lumps them in as "viruses", and 2-Spyware's explainer does the same.

• Virus: attaches itself to other files and needs something to run them.
• Worm: replicates itself across a network, by email, or via removable media.
• Trojan: pretends to be something useful so you run it.

This matters because each worm used a different door. Email lures, a network service flaw, weak passwords and USB drives each need a different defence. There is no single "famous virus" shield.

ILOVEYOU (May 2000): the lesson in a file extension​

According to 2-Spyware's write-up, ILOVEYOU appeared on 4 May 2000. It mailed itself to everyone in an infected person's address book, so the message looked like it came from a trusted friend. It also spread through IRC channels. The script looked like a harmless text file because Windows hid the extensions of known file types.

2-Spyware reports the following figures, and they are estimates. I could not independently corroborate them:

• About 10 percent of internet-connected computers affected.
• 7,000,000 emails received by the Veterans Health Administration alone.
• Damage estimates of roughly US$10 billion, which are estimates, not a count.

Practical takeaway: a sender's name and a file's displayed name prove nothing. Showing full file extensions in File Explorer is still a cheap, sensible habit. The evidence does not show that the original ILOVEYOU script threatens a current, updated Windows install. Modern mail services and Windows do warn about scripts, but 2-Spyware did not test that.

Mydoom (January 2004): the backdoor that outlived the worm​

2-Spyware reports that Mydoom was first seen on 26 January 2004 at about 13:00 UTC. It calls Mydoom the fastest-spreading email worm on record. That is a source claim, not a verified ranking. Mydoom.A opened a backdoor on TCP port 3127 and was set to attack the SCO Group's site from 1 February. Mydoom.B added an attack on Microsoft and edited the hosts file so Microsoft and antivirus sites could not be reached.

Microsoft's own threat description for Doomjuice backs up the backdoor part. Microsoft says Doomjuice.A targets computers infected with Mydoom.A or Mydoom.B and scans for systems listening on TCP port 3127. Microsoft also says it launches a denial-of-service attack against. So the backdoor was real, and other malware abused it.

2-Spyware says Mydoom.A stopped spreading on 12 February 2004 and Mydoom.B on 1 March 2004. It also says the backdoors stayed open on machines that were never cleaned. Nobody in the material I reviewed gives a count of how many such machines remain. Treat leftover Mydoom backdoors as a possibility on very old machines only.

Conficker (November 2008): the one with a paper trail​

Conficker has the strongest primary documentation. Microsoft's threat encyclopedia says Conficker worms infect PCs across a network by exploiting a vulnerability in a Windows system file, which is described and fixed in Security Bulletin MS08-067. Some variants also spread via removable drives and by using common passwords. The family can disable several important Windows services and security products.

Microsoft's variant table dates the first one: Conficker.A was discovered on 21 November 2008 and exploits the MS08-067 vulnerability. Later variants added network shares with weak passwords and mapped or removable drives. They also blocked access to security-related websites.

What Microsoft's 2008 advisory says about patching​

Microsoft Security Advisory 958963 was published on 27 October 2008. It says the published exploit code demonstrated code execution on Windows 2000, Windows XP and Windows Server 2003. It also says the exploit does not affect customers who have installed the MS08-067 updates. The flaw was in how the Server service handled specially crafted RPC requests.

That is the defensible basis for saying this specific door is closed. I would be careful with the broader claim that current Windows is "immune" to anything called Conficker. Microsoft's documents support "patched", and they say nothing about every future file that borrows the name.

How many machines are still infected?​

Figures are shaky and dated. 2-Spyware lists the estimates below, and notes they measure different things:

The source found nothing newer than 2019, so nobody can responsibly give a 2026 number. The machines that remain are most likely old computers that were never updated.

Microsoft's guidance for administrators​

Microsoft's support article on Conficker is written for business environments. Its prevention list includes:

• Use strong administrator passwords that are unique for every computer.
• Don't log on with Domain Admin credentials, or credentials with access to all computers.
• Keep all systems fully updated.
• Disable AutoPlay.
• Remove excessive rights to shares, including write permission at the root of any share.

The article also warns that its mitigation steps only stop the spread. They do not remove the malware, so you still need antivirus or the Microsoft Safety Scanner. Some of the permission changes can block Windows Update and WSUS until they are reverted. Microsoft says the manual removal steps are no longer required if you have antivirus software that can remove the worm. Document your settings first, and restore the defaults afterwards.

Stuxnet (June 2010): the USB drive that crossed the air gap​

2-Spyware says Stuxnet was uncovered on 17 June 2010 by Sergey Ulasen of VirusBlokAda. It targeted Siemens industrial control systems rather than home PCs.

CISA's archived ICS advisory gives the Windows-relevant technical detail:

• Stuxnet used four zero-day exploits, and two of them had been patched at the time of the advisory.
• It took advantage of the same vulnerability Conficker used, MS08-067.
• Known propagation routes included infected USB devices, network shares, STEP 7 project files, WinCC database files, and the print spooler vulnerability fixed in MS10-061.
• It could be updated through command-and-control infrastructure and peer-to-peer RPC.

On authorship, 2-Spyware says the United States and Israel have not officially admitted responsibility and says the authorship should be treated as reported, not proven. I'd keep it that way.

Why it matters to ordinary users: the legacy of Stuxnet is indirect. A USB drive can carry malware into a network that isn't connected to the internet. That's the reason to be wary of drives you find or are handed.

So, can they hurt a current PC?​

Here is how I read the evidence. 2-Spyware's own assessment is based on reading public write-ups, not testing. It says it ran no sample and tried none of its steps on a live infection.

One counterpoint: the lower risk on a modern PC comes from patching and platform changes, not from any guarantee. Well-known names get recycled in phishing and in fake "scan results", so familiarity should raise suspicion, not lower it.

What to do if you meet one​

I did not test any of this on a live infection, and neither did the source. These are reasonable first moves:

1. Don't open it just because the name is familiar. Check where the file or email came from first.
2. If it already ran, open Windows Security, go to Virus & threat protection, and run a full scan. 2-Spyware points to Protection history in Windows Security on Windows 11 24H2/25H2 as the place where a detection and its file path are recorded.
3. Check startup items. In Task Manager, open Startup apps and look for names you don't recognise. Check Task Scheduler for tasks running files from user folders.
4. Check the hosts file (C:\Windows\System32\drivers\etc\hosts, opened as administrator) for lines that redirect Microsoft or antivirus sites. That is what Mydoom.B did in 2004.
5. On an old, unpatched machine, keep it off the network and plan to replace it.
6. At work, tell your IT or security team instead of improvising. Microsoft's Conficker guidance is aimed at administrators, and some cleanup steps affect network resources.

Microsoft also advises a full scan for Conficker, because a full scan might find other, hidden malware (this quote is from its Defender-era guidance). I'd avoid manual registry edits unless an administrator is guiding you. Microsoft's own cleanup pages say those steps carry side effects.

The bottom line​

These worms are history lessons with a few useful rules still attached:

• Treat sender and file names as untrustworthy.
• Patch promptly. One unpatched flaw fuelled a worm that reportedly reached millions of machines.
• Use strong, unique admin passwords.
• Disable AutoPlay where you can, and be cautious with USB drives.
• Retire systems that can no longer get security updates.

The malware has changed a lot since 2010. The habits that stopped it haven't.