Your Ad Here

Saturday, March 14, 2009 Security Advisory - W32.Downadup.C

Discovered: March 6, 2009
Updated: March 11, 2009 4:12:59 PM
Also Known As: Mal/Conficker-B [Sophos], Worm:W32/Downadup.DY [F-Secure]
Type: Trojan, Worm
Infection Length: 88,576 bytes
Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows Vista, Windows XP
W32.Downadup.C is a threat that is downloaded on to the compromised computer by the W32.Downadup family of worms.

Note: Some vendors have detected W32.Downadup samples as Conficker.C or Downadup.B++. Symantec's W32.Downadup.C is a different detection and is not to be confused with these Conficker.C and Downadup.B++ detections.

For more information, please read the following:
W32.Downadup.C Digs in Deeper


  • Initial Rapid Release version March 6, 2009 revision 036
  • Latest Rapid Release version March 13, 2009 revision 064
  • Initial Daily Certified version March 6, 2009 revision 037
  • Latest Daily Certified version March 14, 2009 revision 003
  • Initial Weekly Certified release date March 11, 2009

Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

Threat Assessment


  • Wild Level: Low
  • Number of Infections: 0 - 49
  • Number of Sites: 0 - 2
  • Geographical Distribution: Low
  • Threat Containment: Easy
  • Removal: Easy


  • Damage Level: High
  • Payload Trigger: File downloading is triggered after 1st April 2009.
  • Payload: Attempts to download files from a predetermined list of addresses. Also attempts to intercept and redirect DNS requests to prevent access to certain Web sites.
  • Compromises Security Settings: Stops certain Windows services and security related processes.


  • Distribution Level: Low
  • Target of Infection: Computers already infected by earlier variants of the W32.Downadup family of worms.

No comments: