W32.Duqu is a Trojan that opens a back door and downloads more files on to the compromised computer. It also has rootkit functionality and may steal information from the compromised computer.
The Trojan may arrive as a Microsoft Word document containing an exploit for the
Microsoft Windows 'Win32k.sys' TrueType Font Handling Remote Code Execution Vulnerability (BID 50462). Successful exploitation of the vulnerability will enable the Trojan to be dropped and executed on the targeted computer.
Initial analysis of this threat has shown that it is closely related to the
W32.Stuxnet worm from 2010. More information about W32.Duqu and W32.Stuxnet can be found in the following resources:
Note: Virus definitions dated October 18, 2011 or earlier detect this threat as
Trojan Horse.
Click for a more detailed description of Rapid Release and Daily Certified virus definitions.
