quote:

Remove your Downadup infection!

BitDefender Labs has detected a new and more aggressive Downadup version on Saturday, 07.02.2009. It spreads using a Windows RPC Server Service vulnerability and is called Win32.Worm.Downadup.Gen.

The new version is more resilient to disinfection. Once the system is compromised, the worm disables Windows Update and blocks access to most of the anti-virus websites in order to hinder the user to disinfect his machine.

BitDefender is the first to offer a free tool which disinfects all versions of Downadup and is available for all infected users at: http://bdtools.net This domain is the first to serve a removal tool without being blocked by the e-threat.

The worm itself is not new, it made its first appearance late November 2008, known under the names Conficker or Kido as well exploiting the vulnerability described in the Microsoft security bulletin MS08-067. After successful exploitation it used to install rogue security software on the infected machine.

quote:

Just download the zip file (bd_rem_tool.zip), double click on it, chose "Extract all files..." from the File menu, and follow the wizard's instructions. You can use any other archiver, like WinZip. This will create a folder called bd_rem_tool.

Inside it, find the program called "bd_rem_tool.exe" (or just "bd_rem_tool") and double click on it. It is very important to extract all the files from the zip archive, and not only bd_rem_tool.exe, because all the other files are needed for the disinfection. Then follow the tool's instructions.

If you have Windows Vista with User Access Control enabled, or if you are running as a restricted user in Windows XP, right click the "bd_rem_tool" program and choose "Run as Administrator". You will be prompted to enter credentials for an admin account.