EMEA Endpoint Management and Mobility Group (EMM)

 View Only

  • 1.  rundll32.dll run because of w32.Downadup.b virus

    Posted Nov 14, 2013 12:52 AM

     

    I am facing issue of process interrupt because of rundll32.dll and this virus is found as w32.Downadup.b

     

     As per Symantec if we want to protect the system from this virus we need to deploy windows patch on the system for this I have one link do download this please verify  

    http://technet.microsoft.com/en-us/security/bulletin/ms08-067

     

     

    And provide me any other solution is available for this

     



  • 2.  RE: rundll32.dll run because of w32.Downadup.b virus
    Best Answer

    Trusted Advisor
    Posted Nov 14, 2013 05:49 AM

    Hello,

    Here is the Documentation on the W32.Downadup (Symantec) aka Conficker (Microsoft)

    Best Practice for Downadup.B and Additional information on the same.

    https://www-secure.symantec.com/connect/articles/best-practice-downadupb-and-additional-information-same

    Downadup (conficker) is quite old virus. If all machines are patched and udpated with the newest virus definitions you should be safe. However, there are few things to be verified. This is well described in the following document:

    Simple steps to protect yourself from the Conficker Worm

    http://service1.symantec.com/support/ent-security.nsf/docid/2009033012483648

    Work on the Plan of Action as given below for a 100% result.

    Plan of Action:

    1) Make sure ALL Computers are installed with Symantec EP with latest / updated with virus defintions and

    2) Install MS08-67 patch download [KB 958644] on ALL computer.

    http://www.microsoft.com/technet/security/Bulletin/MS08-067.mspx

    3) Install ALL Latest Microsoft Secuirty Patches / Sevice Packs on ALL machines

    4) Disable Auto play with GPO

    http://support.microsoft.com/kb/953252

    5) Disable Scheduled Tasks with GPO

    http://support.microsoft.com/kb/310208

    6) Enable Security Auditing with GPO

    http://support.microsoft.com/kb/300549

    7) Scan ALL the machines...

    8) Enable Risk Tracer

    http://www.symantec.com/docs/TECH102539

    Incase, we don't have Network Threat Protection Installed on Machines, then we could try NMAP (http://insecure.org/)

    NOTE: NMAP is not Supported by Symantec. However, have proved to be effective.

    NOTE: *ALL means ALL client machines and server machines (make sure you don't miss any machine)

    Similar Threads: 

    https://www-secure.symantec.com/connect/forums/w32downadupb-how-could-you-find-source-if-there-are-1k-infected

    https://www-secure.symantec.com/connect/forums/w32downadupb-5

    https://www-secure.symantec.com/connect/forums/account-lockdown-pertaining-domain-controller

    Hope that helps!!