W32.Downadup.B

W32.Downadup.B is a worm that spreads by exploiting the Microsoft Windows Server Service RPC Handling Remote Code Execution Vulnerability (BID 31874). It also attempts to spread to network shares protected by weak passwords and block access to security-related Web sites.

Note: After reviewing W32.Downadup.B, Symantec recommends reviewing details of W32.Downadup and W32.Downadup!autorun as well.

For more information, please read the following:

• W32.Downadup Infection Statistics
• New Variants of W32.Downadup.B Find New Ways to Propagate
• W32.Downadup.A and W32.Downadup.B Statistics
• Downadup: Peer-to-Peer Payload Distribution
• Downadup: Geo-location, Fingerprinting, and Piracy
• Downadup: A Lock with No Key
• Downadup: Small Improvements Yield Big Returns
• Downadup: Attempts at Smart Network Scanning
• Downadup: Playing with Universal Plug and Play
  
• Coalition Formed in Response to W32.Downadup
• Downadup: Locking Itself Out
• A New Downadup Variant?
• Downadup—Advanced Crypto Protection
• Downadup Motivations
• Downadup-Related Search Indexes Poisoned with Fake AV Sites
• W32.Downadup.C Pseudo-Random Domain Name Generation
• Conficker Used for Fake Antivirus Software Sale
• Downadup + Waledac?
• W32.Downadup.E—Back to Basics
• The Downadup Codex, Edition 2.0
  

Protection

• Initial Rapid Release version December 30, 2008 revision 021
• Latest Rapid Release version February 5, 2010 revision 007
• Initial Daily Certified version December 30, 2008 revision 024
• Latest Daily Certified version February 5, 2010 revision 032
• Initial Weekly Certified release date December 31, 2008

Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

Threat Assessment

Wild

• Wild Level: Medium
• Number of Infections: 1000+
• Number of Sites: 10+
• Geographical Distribution: Medium
• Threat Containment: Moderate
• Removal: Moderate

Damage

• Damage Level: Medium
• Modifies Files: Modifies the tcpip.sys file.

Distribution

• Distribution Level: Medium
• Shared Drives: Attempts to spread to network shares protected by weak passwords.
• Target of Infection: Spreads by exploiting the Microsoft Windows Server Service RPC Handling Remote Code Execution Vulnerability (BID 31874)