Discovered: April 9, 2009
Updated: April 13, 2009 9:03:35 PM
Also Known As: WORM_DOWNAD.E [Trend]
Type: Worm
Infection Length: 119,296 bytes
Systems Affected: Windows 98, Windows 95, Windows XP, Windows Me, Windows Vista, Windows NT, Windows Server 2003, Windows 2000
W32.Downadup.E is a worm that spreads by exploiting the
Microsoft Windows Server Service RPC Handling Remote Code Execution Vulnerability (BID 31874). It also drops a copy of
W32.Downadup.C.
For more information, please read the following: Protection
-
Initial Rapid Release version April 9, 2009 revision 009
-
Latest Rapid Release version May 21, 2009 revision 021
-
Initial Daily Certified version April 9, 2009 revision 009
-
Latest Daily Certified version May 21, 2009 revision 023
-
Initial Weekly Certified release date April 15, 2009
Click for a more detailed description of Rapid Release and Daily Certified virus definitions.
Threat Assessment
Wild
-
Wild Level: Low
-
Number of Infections: 0 - 49
-
Number of Sites: 0 - 2
-
Geographical Distribution: Low
-
Threat Containment: Easy
-
Removal: Easy
Damage
Distribution
-
Distribution Level: Medium
-
Target of Infection: Spreads by exploiting the Microsoft Windows Server Service RPC Handling Remote Code Execution Vulnerability.
Writeup By: Kachun Leung, Yana Liu and Sean Kiernan
Technorati
Digg
Delicious
Reddit
StumbleUpon
Facebook
Yahoo
Twitter
Faves
Newsvine
