Home > Threat descriptions >



Category: Malware

Type: Worm

Aliases: Worm:W32/Downadup.gen, Net-Worm.Win32.Kido, Win32.Worm.Downadup.Gen, Win32.Worm.DownadupINF.Gen, Worm:W32/Downadup.gen, Worm:W32/Downadup.gen!A


Worm:W32/Downadup.gen is a generic detection of Worm:W32/Downadup.

Generic detections are broad patterns of code or behavior that are used by security software to identify programs or files. If you suspect the detected file was incorrectly identified, go to: Removal: Resolve a False Positive.


Automatic action

Once detected, the F-Secure security product will automatically handle a harmful program or file by either deleting or renaming it.


Downadup makes use of random extension names in order to avoid detection. During disinfection, Scanning Options should be set to:

  • Scan all files

For more general information on disinfection, please see Removal Instructions.

Removal tools

Some variants of the Downadup worm attempt to block execution of F-Secure malware removal tools. If the downloaded tool does not work, please rename the file. Example: from "f-downadup.exe" to "file.exe" or "explorer.exe". Then try running the tool again.


Specific tool with heuristics for Downadup worm variants:

This is a command line tool. Please read the text file included in the ZIP for additional details.

Microsoft Help and Support

Knowledge Base Article 962007 provides numerous details for manual disinfection of Conficker.B (alias Downadup):

Knowledge Base

Find the latest advice in our Community Knowledge Base.

About the product

See the manual for your F-Secure product on the Help Center.

Contact Support

Chat with or call an expert for help.

Submit a sample

Submit a file or URL for further analysis.

Technical Details

For technical details of Downadup's installation and propagation mechanisms, see the following descriptions:


Downadup uses a variety of methods and vectors to spread itself:

  • Exploits a Windows vulnerability; patched by security update 958644 (read our Vulnerability Report, SA32326: Microsoft Windows Server Service Vulnerability).
  • Use of network shares; weak passwords.
  • It uses Windows AutoRun functionality; autorun.inf files are copied to USB drives and other removable media.

Certain Downadup variants have additional rooutines:

Date Created: 2009-01-09 11:53:48.0

Date Last Modified: 2010-09-29 09:40:20.0