W32.Downadup.B

31 December 2008 Worm 27 Comments

W32.Downadup.B is a worm that propagates and infects computers by exploiting the Microsoft Windows Server Service RPC Handling Remote Code Execution Vulnerability. W32.Downadup.B will reduce security settings of compromised computer by ending security-related process and blocks them from accessing security websites. This worm will spread on unsecured network shares and removable USB drives.

Alias: Win32/Conficker.A, Mal/Conficker-A, Trojan.Win32.Agent.bccs, Worm:Win32/Conficker.B

Damage Level: Medium

Systems Affected: Windows 9x, 2000, XP, Windows Vista

Characteristics
When W32.Downadup.B is executed, it will attempt to copy itself under System folder of Windows as a hidden file. To evade anti-virus detection, the worm will use random file name. This worm will also make a duplicate copy on the following locations:
%ProgramFiles%\Internet Explorer
%ProgramFiles%\Movie Maker

To make sure that the file will run on every Windows start-up, W32.Downadup.B will create this registry entry.
HKCU\Software\Microsoft\Windows\CurrentVersion\Run = “(random characters)”

Presence of this worm may cause the computer to misbehave. The worm will perform various harmful tasks including the following:

• It will modify system settings to restrict access to some files and folders.
• The worm may disable TCP/IP services.
• This worm will generate its own service and run once Windows is started.
• W32.Downadup.B deletes system restore point and prevents running Windows System Restore.
• Monitor Internet activities of the infected computer.
• The worm may subsequently connect to a predefined URL to download arbitrary files.

Distribution
The worm can be downloaded from unknown web sites without users consent. It attempts to exploit security breaches in Windows Server service to penetrate victim’s computer.
W32.Downadup.B commonly spreads and infects other computers on a network environment. It will dropped a copy of itself on all network mapped drives and removable devices. To trigger an autoplay when the drive is accessed, it will include Autorun.Inf that launches the worm.

Added Registry Entries:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\"[RANDOM NAME]" = "rundll32.exe "[random characters].dll", rtujmmer"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\[Service Created By W32.Downadup.B]\Parameters\"ServiceDll" = "[PATH TO WORM]"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\[Service Created By W32.Downadup.B]\"ImagePath" = %SystemRoot%\system32\svchost.exe -k netsvcs
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\[Service Created By W32.Downadup.B]\"Type" = "4"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\[Service Created By W32.Downadup.B]\"Start" = "4"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\[Service Created By W32.Downadup.B]\"ErrorControl" = "4"

Associated Files and Folders:

%ProgramFiles%\Internet Explorer\[random characters].dll
%ProgramFiles%\Movie Maker\[random characters].dll
%System%\[random characters].dll
%Temp%\[random characters].dll
C:\Documents and Settings\All Users\Application Data \[random characters].dll

File Location for Windows Versions:

• %System% for all versions of Windows it is located under C:\Windows\System32
• %Temp% refers to C:\Windows\Temp\.

W32.Downadup.B Removal Tool

1. Download the Downadup removal tool and save it on Desktop.

2. Double click on downloaded file, chose "Extract all files..." from the File menu, and follow the wizard's instructions. You can use any other archiver, like WinZip. This will create a folder called bd_rem_tool.

3. Double click on the file "bd_rem_tool_gui.exe" (or just "bd_rem_tool_gui"). Make sure that all files have been extracted from the zip archive, because all the contents are required for the removal tool to run. Follow the tool's instructions.

4. If you have Restricted Access (not Admin) on Windows Vista and XP, right click the "bd_rem_tool_gui" program and choose "Run as Administrator". Enter the computer Administrator User-name and Password when prompted.

5. Reboot your computer when scanning is finished.

Manual Removal Procedure

1. If an anti-virus program is present, update the definition file.
2. Reboot Windows in Safe Mode
- After turning on the power, press F8 on the keyboard.
- From the menu, select Safe Mode.

3. Run a full system scan and clean/delete all infected files.
4. Delete/Modify any values added to the registry if present.
- To edit the registry, click on Start. Search or Run regedit.

5. Exit registry editor and restart Windows.