Downadup worm
A new version of the Downadup worm infects Windows workstations and servers on corporate networks. Since the new year, F-Secure has received several reports of corporate network infections and is working closely with these companies, as well as various CERT organisations, to fight this outbreak.
Downadup (also known as Conficker) is a large family of network worms that is unusually difficult to remove, especially in the case of an internal infection inside a corporate network.
W32/Downadup is an email worm. The worm will infect Windows systems.
Upon execution, the worm drops svchost.exe in the Windows System folder.
The worm modifies registry at the following locations to register itself as a system service:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\ServicesWhat does the worm do? Part 11
What to do if you're infected? Part 111
Labels: Advanced news