Note: Some vendors have detected W32.Downadup samples as Conficker.C or Downadup.B++. Symantec's W32.Downadup.C is a different detection and is not to be confused with these Conficker.C and Downadup.B++ detections.
For more information, please read the following:
W32.Downadup.C Digs in Deeper
- Initial Rapid Release version March 6, 2009 revision 036
- Latest Rapid Release version March 13, 2009 revision 064
- Initial Daily Certified version March 6, 2009 revision 037
- Latest Daily Certified version March 14, 2009 revision 003
- Initial Weekly Certified release date March 11, 2009
Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.
- Wild Level: Low
- Number of Infections: 0 - 49
- Number of Sites: 0 - 2
- Geographical Distribution: Low
- Threat Containment: Easy
- Removal: Easy
- Damage Level: High
- Payload Trigger: File downloading is triggered after 1st April 2009.
- Payload: Attempts to download files from a predetermined list of addresses. Also attempts to intercept and redirect DNS requests to prevent access to certain Web sites.
- Compromises Security Settings: Stops certain Windows services and security related processes.
- Distribution Level: Low
- Target of Infection: Computers already infected by earlier variants of the W32.Downadup family of worms.