1. Skip to navigation
  2. Skip to content
  3. Skip to secondary-content

Where You Are

  1. Labs
  2. Threats
  3. Virus and threat descriptions
  4. Worm:W32/Downadup.gen

Worm:W32/Downadup.gen

Detection Names : Net-Worm.Win32.Kido
Win32.Worm.Downadup.Gen, Win32.Worm.DownadupINF.Gen
Worm:W32/Downadup.gen, Worm:W32/Downadup.gen!A
Aliases : W32/Conficker.worm.gen (Symantec)
Worm:Win32/Conficker (Microsoft)
Mal/Conficker (Sophos)
Category:Malware
Type:Worm
Platform:W32

Summary

Worm:W32/Downadup.gen is a Generic Detection of Worm:W32/Downadup.

Disinfection

UPDATE

Recent variants of the Downadup worm attempt to block execution of F-Secure malware removal tools. If the downloaded tool does not work, please rename the file. Example: from "f-downadup.exe" to "file.exe" or "explorer.exe". Then try running the tool again.


REMOVAL TOOLS

These are command line tools, please read the text file included in the ZIP for additional details. As they are also beta tools, use the following FTP location to determine the file dates:


F-Downadup

Specific tool with heuristics for Downadup worm variants:


FSMRT

Non-specific detection tool, larger file size:


Scanning Options

Downadup makes use of random extension names in order to avoid detection.

During disinfection scanning options should be set to:

  • Scan all files

Microsoft Help and Support

Knowledge Base Article 962007 provides numerous details for manual disinfection of Conficker.B (alias Downadup):

Additional Details

For technical details of Downadup's installation and propagation mechanisms, see the following descriptions:


Propagation

Downadup uses a variety of methods and vectors to spread itself:

  • Exploits a Windows vulnerability; patched by security update 958644 (read our Vulnerability Report, SA32326: Microsoft Windows Server Service Vulnerability).
  • Use of network shares; weak passwords.
  • It uses Windows AutoRun functionality; autorun.inf files are copied to USB drives and other removable media.

Certain Downadup variants have additional rooutines:


About Generic Detections

Unlike more traditional detections (also known as signatures or single-file detections) a Generic Detection does not identify a unique or individual malicious program. Instead, a Generic Detection looks for broadly applicable code or behavior characteristics that indicate a file as potentially malicious, so that a single Generic Detection can efficiently identify dozens, or even hundreds of malware.

For more information about Generic Detections, see the Generic Detection description.