W32.Downadup.C

Risk Level 2: Low

Discovered: March 6, 2009

Updated: April 6, 2009 6:30:44 PM

Also Known As: Mal/Conficker-B [Sophos], Worm:W32/Downadup.DY [F-Secure], Trojan-Downloader.Win32.Kido.a [Kaspersky]

Type: Trojan, Worm

Infection Length: 88,576 bytes

Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows Vista, Windows XP

W32.Downadup.C is a threat that is downloaded on to the compromised computer by the W32.Downadup family of worms.

Note:

Some vendors have detected W32.Downadup samples as Conficker.C or Downadup.B++. Symantec's W32.Downadup.C is a different detection and is not to be confused with these Conficker.C and Downadup.B++ detections.
After reviewing W32.Downadup.C, Symantec recommends reviewing details of W32.Downadup.B as well.

For more information, please read the following:

Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

Damage Level: High
Payload Trigger: File downloading is triggered after 1st April 2009.
Payload: Attempts to download files from a predetermined list of addresses. Also attempts to intercept and redirect DNS requests to prevent access to certain Web sites.
Compromises Security Settings: Stops certain Windows services and security related processes.

Distribution Level: Medium
Target of Infection: Computers already infected by earlier variants of the W32.Downadup family of worms.

Writeup By: Ka Chun Leung and Sean Kiernan

Search Threats

Search by name

_{Example: W32.Beagle.AG@mm}