W32.Downadup

24 November 2008 Worm 63 Comments

W32.Downadup is a worm that can kill antivirus programs and block infected computers from visiting legitimate security web sites. This worm also spreads on local and network drives by taking advantage of the Microsoft Windows Server Service RPC Handling Remote Code Execution Vulnerability. W32.Downadup also creates its own Service on Windows to run itself each time Windows starts. Its method to spread stretches from local network and the Internet by taking advantages of software and security weaknesses.

Characteristics
When executed, W32.Downadup will drop files on various locations on the hard drive. It will also modify the registry and add an entry that will result to automatic loading of the virus when Windows starts.

Alternative way for self start-up is to create a service driver. It drops the following file for the said process.
%System%\0[RANDOM FILE NAME].tmp

Once inside the computer, user may notice several abnormalities. One of which is presence of files and folders consisting of random names. This worm may also modify and delete files and folders. It also lowers security setting by deleting registry entries that are associated to antivirus and other protection software.

The primary goal of W32.Downadup is to spread other types of threats. In its initial release, the worm involves in various activities that causes spread of fake antivirus software, also known as rogue security program. This fraud behavior will push computer users to purchase a useless program through misleading techniques.

This worm heavily operates on peer-to-peer network connection to distribute another harmful code in the form of W32.Waledac.

Distribution
W32.Downadup family of worms is probably the most productive in current era. It quickly spread and infected at least half a million computers in its initial released. It uses various propagation channels and maximizes the Internet to reach interconnected victims via this method.

  • Exploiting security in Internet browsers to enter the computer
  • Take advantage of Windows and Server vulnerability
  • Make a copy of itself to removable media drives and execute through Autorun functions
  • Drop malicious files on network shared folder and drives

Technical Details and Additional Information:

Alias: Win32/Conficker.A, W32/Downadup.A, Conficker.A, Net-Worm.Win32.Kido.bt, WORM_DOWNAD.AP, W32/Conficker

Damage Level: High

Systems Affected: Windows 9x, 2000, XP, Windows Vista

Other functionalities of this Worm:
- W32.Downadup will create files and folders with random characters.
- This Worm W32.Downadup will connect to a remote server to download an updated copy of itself.
- It can block access to security web sites by monitoring and redirecting domain request.

Added Registry Entries:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\"[Random Characters]" = "rundll32.exe [RANDOM DLL File], [RANDOM Parameter String]"
Associated Files and Folders:
%ProgramFiles%\Internet Explorer\[RANDOM FILE NAME].dll
%ProgramFiles%\Movie Maker\[RANDOM FILE NAME].dll
C:\Documents and Settings\All Users\Application Data \[RANDOM FILE NAME].dll
%System%\[RANDOM FILE NAME].dll
%System%\000[RANDOM FILE NAME].tmp
%System%\[RANDOM FILE NAME].dll
%Temp%\[CLSID 3]\[NUMBER].tmp
%Temp%\[RANDOM FILE NAME].dll
%Temp%\[RANDOM FILE NAME].exe


File Location for Windows Versions:
%System% for all versions of Windows is located under C:\Windows\System32
%Temp% refers to C:\Windows\Temp\.

How to Remove W32.Downadup

Restore Windows Components

If the worm have compromised the system, registry and legitimate Windows files are also compromised. System Restore can reinstate clean system files by restoring the configuration to an earlier date. If a restore point was created before you got infected with W32.Downadup, please restore Windows to previous configuration.

W32.Downadup Removal Tool

1. Download the tool D.exe from Symantec web site.
2. Save it to a desired location.
3. After download completes, disconnect the computer from Internet.

4. Computers who are running under operating system Windows ME and Windows XP must disable System Restore.

5. Reboot Windows in Safe Mode.
- After turning on the power, press F8 on the keyboard.
- Select Safe Mode from the menu.

6. Go to D.exe download location on your hard drive.
7. Double click D.exe to run the tool.
8. Let the tool thoroughly scan the computer and perform another scan after rebooting Windows in normal mode.

Manual Removal Procedure:

1. Update installed anti-virus application to have the latest definition file.
2. Reboot Windows in Safe Mode
- After turning on the power, press F8 on the keyboard.
- Select Safe Mode from the menu.

3. Thoroughly scan the system and clean/delete all infected files.
4. Delete/Modify any values added to the registry if present. Refer to associated Windows Registry Entries.
- Click on Start. Search or Run regedit.exe to begin registry editor.

5. Exit registry editor and restart Windows.

Additional Tools and Programs

Scan with Norton Power Eraser: A free removal tool from Norton Antivirus was developed to remove virus and unfamiliar threats without using the traditional AV signatures. Download the tool from this location and start scanning the computer for viruses.

What to do next...