W32.Downadup

Risk Level 2: Low

Download Removal Tool | Printer Friendly Page

Discovered: November 21, 2008

Updated: November 24, 2008 9:37:07 AM

Also Known As: Win32/Conficker.A [Computer Associates], W32/Downadup.A [F-Secure], Conficker.A [Panda Software], Net-Worm.Win32.Kido.bt [Kaspersky], WORM_DOWNAD.AP [Trend], W32/Conficker [Norman]

Type: Worm

Infection Length: 62,976 bytes

Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows Vista, Windows XP

CVE References: CVE-2008-4250

W32.Downadup is a worm that spreads by exploiting the Microsoft Windows Server Service RPC Handling Remote Code Execution Vulnerability (BID 31874).

Note: After reviewing W32.Downadup, Symantec recommends reviewing details of W32.Downadup.B and W32.Downadup!autorun as well.

For more information, please read the following:

Protection

Initial Rapid Release version November 21, 2008 revision 052
Latest Rapid Release version August 13, 2009 revision 032
Initial Daily Certified version November 22, 2008 revision 003
Latest Daily Certified version August 14, 2009 revision 004
Initial Weekly Certified release date November 26, 2008

Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

Threat Assessment

Wild

Wild Level: Medium
Number of Infections: 1000+
Number of Sites: 10+
Geographical Distribution: Medium
Threat Containment: Moderate
Removal: Moderate

Damage

Damage Level: Medium
Payload: Downloads other files on to the compromised computer.
Degrades Performance: Downloading remote files may degrade network performance.

Distribution

Distribution Level: Medium
Target of Infection: Exploits a certain vulnerability.

Writeup By: Takayoshi Nakayama and Sean Kiernan

Technical Details

Search Threats

Search by name

_{Example: W32.Beagle.AG@mm}