SecurityOrb.com Security Advisory - W32.Downadup.C

Discovered: March 6, 2009

Updated: March 11, 2009 4:12:59 PM

Also Known As: Mal/Conficker-B [Sophos], Worm:W32/Downadup.DY [F-Secure]

Type: Trojan, Worm

Infection Length: 88,576 bytes

Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows Vista, Windows XP

W32.Downadup.C is a threat that is downloaded on to the compromised computer by the W32.Downadup family of worms.

Note: Some vendors have detected W32.Downadup samples as Conficker.C or Downadup.B++. Symantec's W32.Downadup.C is a different detection and is not to be confused with these Conficker.C and Downadup.B++ detections.

For more information, please read the following:
W32.Downadup.C Digs in Deeper

Protection

• Initial Rapid Release version March 6, 2009 revision 036
• Latest Rapid Release version March 13, 2009 revision 064
• Initial Daily Certified version March 6, 2009 revision 037
• Latest Daily Certified version March 14, 2009 revision 003
• Initial Weekly Certified release date March 11, 2009

Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

Threat Assessment

Wild

• Wild Level: Low
• Number of Infections: 0 - 49
• Number of Sites: 0 - 2
• Geographical Distribution: Low
• Threat Containment: Easy
• Removal: Easy

Damage

• Damage Level: High
• Payload Trigger: File downloading is triggered after 1st April 2009.
• Payload: Attempts to download files from a predetermined list of addresses. Also attempts to intercept and redirect DNS requests to prevent access to certain Web sites.
• Compromises Security Settings: Stops certain Windows services and security related processes.

Distribution

• Distribution Level: Low
• Target of Infection: Computers already infected by earlier variants of the W32.Downadup family of worms.