How to Remove W32.Downadup.B Worm

W32.Downadup.B is a worm that tends to replicate itself through networks infecting all the subsidiary nodes and causing severe system trouble for each of the network units. W32.Downadup.B is known to contaminate target systems by exploiting Windows Server Service vulnerability. W32.Downadup.B has an enormous propagation scope – starting from December 2008 up till now, it has infected up to 20 million computers all over the planet. When operating, W32.Downadup.B disables the access to some domains and concurrently triggers the “Network request timed out” alert or some other similar one. W32.Downadup.B also creates a file in all the drives called ‘autorun.inf’, and schedules lot of tasks to run , this file is automatically executed. Once launched, autorun.inf will attempt to spot other machines connected to the infected one, in order to access them illicitly as well. W32.Downadup.B is hard to remove manually or using most spyware removal tools. If you suspect W32.Downadup.B in your system, you should immediately remove the system from network and disable file and printer sharing of infected system and perform a scan with a trusted utility, and if detected, eliminate W32.Downadup.B. And it’s preferable to put your firewall on and disable File and Printer Sharing allow only trusted systems.


How to remove W32.Downadup.B manually:

To perform manual removal of W32.Downadup.B worm, you should do the following:

Delete W32.Downadup.B corrupt files:

    * svchost.exe
    * explorer.exe
    * services.exe
    * %System%\[Random].dll
    * %Program Files%\Internet Explorer\[Random].dll
    * %Program Files%\Movie Maker\[Random].dll
    * %All Users Application Data%\[Random].dll
    * %Temp%\[Random].dll


Remove W32.Downadup.B registry entries:

    * HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\Advanced\Folder\Hidden\SHO WALLCheckedValue = dword:00000000
    * HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\WindowsNT\CurrentVersion\SvcHost, netsvcs = %Previous data% and %Random%
    * HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\[random]\ParametersServiceDll = %MalwarePath%

Please, note that manual removal of W32.Downadup.B worm is a procedure of high complexity and should be performed with extreme caution. Lack of the required skills and even the slightest deviation from the instructions may lead to irreparable system damage. To ensure trouble-free deletion, it is recommended to use the automatic W32.Downadup.B removal tool below:

Click to Download and Get-rid of this Worm