Where to Buy Trend Micro Products

For Home

For Small Business

1-888-762-8736
(M-F 8:00am-5:00pm CST)

For Enterprise

1-877-218-7353
(M-F 8:00am-5:00pm CST)

Not in the United States?
Select the country/language of your choice:

Asia Pacific Region

Europe

The Americas

Not in the United States?
Select the country/language of your choice:

Asia/Pacific

Europe

America

Login

For Home

For Business

For Partners

Threat Encyclopedia

WORM_DOWNAD


ALIASES:

Conficker, Kido, Downadup, Downad

PLATFORM:

Windows 2000, Widnows XP, Windows Server 2003

OVERALL RISK RATING:
DAMAGE POTENTIAL:
DISTRIBUTION POTENTIAL:
REPORTED INFECTION:
INFORMATION EXPOSURE:

  • Threat Type:Worm

  • Destructiveness:No

  • Encrypted:

  • In the wild: Yes

OVERVIEW

TECHNICAL DETAILS

SOLUTION

Minimum Scan Engine:

8.900

VSAPI OPR PATTERN File:

7.733.00

VSAPI OPR PATTERN Date:

28 Dec 2010

NOTES:

Trend Micro OfficeScan users are also urged to use the following features to protect from WORM_DOWNAD malware:

Enabling Device Access Control

  1. Open the OfficeScan web console.
  2. In the left panel, click Networked Computers to expand its list of contents.
  3. Click Client Management to open the user interface found in the right panel.
  4. In the right panel, click Setting and choose Device Control Settings from the dropdown list.
  5. Click Enable Device Control then Block Autorun function on USB devices after setting your desired permissions.
  6. At the bottom of the window, click Apply to All Clients.

Enabling USB Autoscan

For Trend Micro OfficeScan 10.6 SP1 and later, enable this Trend Micro OfficeScan feature, please refer to the following eSupport page:

Enabling Scan Network Drive

  1. Still in the OfficeScan web console, in the left panel, click Networked Computers to expand its list of contents.
  2. Click Client Management to open user interface on the right panel.
  3. In the right panel, click Settings and select Scan Settings>Real-time Scan Settings.
  4. In Scan Settings, check Scan network drive.
  5. At the bottom of the window, click Apply to All Clients.

Enabling Web Reputation Service

  1. Still in the OfficeScan web console, in the left panel, click Networked Computers.
  2. Click Client Management to open user interface on the right panel.
  3. In the right panel, click Settings, then choose Web Reputation Settings from the dropdown list. This opens a new window where you can configure the Web Reputation service settings.
  4. Check Enable Web reputation policy on the following operation systems.
  5. At the bottom of the window, click Apply to All.

Enabling Firewall Feature

  1. Still in the OfficeScan web console, in the left panel, click Networked Computers.
  2. Click Client Management to open user interface on the right panel.
  3. In the right panel, click Settings, then choose Additional Service Settings from the dropdown list. This opens a new window where you can enable firewall service.
  4. Check Enable service ion the following operating systems.
  5. At the bottom of the window, click Apply to All Clients.

Trend Micro OfficeScan users may also install and configure the Intrusion Defense Firewall (IDF) plugin to further prevent WORM_DOWNAD infections.

Configuring IDF to Protect from DOWNAD infections

  1. Right-click Selected Computer Group>Actions>Deploy Client Plug-in(s).
  2. Create a Security Profile. Select Security Profiles in the IDF console. Right-click Windows Workstation Profile then select Duplicate. Then you may rename the Security Profile.
    Note: Skip this step if there is an existing IDF profile.
  3. Disable the IDF firewall to preserve the Officescan Firewall. In the Security Profile Window, select Firewall and uncheck Inherit. Then select Off.
  4. Enable corresponding IDF rules by doing the following:
    • Select Deep Packet Inspection and uncheck Inherit, then Select On and Prevent.

    • Under DPI rules, select IDS/IPS. In the upper right corner, type in CVE-2008-4250 and press Enter.

    • Wait for the relevant IDF rules to be found and check all IDF rules, then click Save.
  5. Assign the security profile to the select computer group by doing the following:
    • Right-click on Computer Group>Actions>Assign Security Profile.

    • Select the newly created Security Profile, then click OK.
  6. To check if the IDF plugin was properly configured, Select a machine inside the selected Computer Group. The expected status are the following: Managed (Online), Firewall: Off, DPI: Prevent, 4 rules.


Did this description help? Tell us how we did.

Featured Stories

Connect with us on