ARN

Symantec identifies third Downadup/Conficker variant

Downadup variant is better at defending itself from anti-malware technologies.

A third version of Downadup has been identified by Symantec, which says the new variant gives infected machines more powerful instructions to disable anti-virus software and analysis tools, among other actions.

W32.Downadup.C is a modular component for machines currently infected with Downadup. This variant of Downadup, also called Conficker, is not attempting to self-replicate and appears to behave more like a Trojan than a worm, says Vincent Weafer, vice president of Symantec Security Response.

"Think of it as an updated module that's more aggressive, more robust in defending itself," Weafer says.

The W32 Downadup.C variant was discovered Friday in a Symantec honeypot and is still under investigation. Symantec expects to identify additional capabilities shortly, says Weafer, who adds that Symantec has not yet seen W32.Downadup.C in customer networks directly.

Earlier versions of Downadup did attempt to disable anti-virus software, but the third version represented in the Downadup.C module is designed mainly to provide more protective actions to infected Windows-based machines so they can better defend themselves from anti-virus software and other eradication methods.

"It's more aggressive, it has more services," says Weafer.

Nominations for the 2012 ARN IT Industry Awards open on Tuesday, June 12.

More about: Symantec
References show all

Comments

Post new comment

The content of this field is kept private and will not be shown publicly.
Users posting comments agree to the ARN comments policy.
Login or register to link comments to your user profile, or you may also post a comment without being logged in.
Related Coverage
Related Whitepapers
Latest Stories
Community Comments
Tags: downadup, worm
ARN Directory | Distributors relevant to this article
Anyware Corporation , Aquion , ASI Solutions , Dicker Data , Express Data , Express Online , Impact Systems Technology , Lynx Technologies , Topstar Computer International , Xpress I.T.
ARN Directory | Vendors relevant to this article
Symantec
rhs_login_lockGet exclusive access to ARN's news, research and invitation only events.
ARN Distributor Directory
Find distributors by name | vendor | location
Channel Deals
/deals/aca-pacific/442_rimage-trade-in-program-inkjet-to-everest-ther
ACA Pacific

Rimage Trade-In Program - Inkjet-to-Everest Thermal Printing. Ends June 15th, 2012.

More details »
ARN Vendor Directory
Find vendors by name | category

iAsset is a channel management ecosystem that automates all major aspects of the entire sales,marketing and service process, including data tracking, integrated learning, knowledge management and product lifecycle management.