Published in News

Conficker starts updating

by on09 April 2009

Image

Using P2P between infected systems

The first round of alarms that were sounded over Conficker went largely ignored, but TrendMicro says that those infected with the Conficker worm are now communicating with each other via peer-to-peer and they have started to drop a new mystery payload on infected machines.

TrendMicro says that they are still looking at the payload that is being dropped, but most of the insiders that we talked to suspect that it dropping a keylogger or perhaps some other stealth software that is being hidden in a rootkit that will allow the stealing of sensitive data.

Much is still not known about the Conficker payload due to the fact that the software is heavily encrypted, which makes analysis difficult, at best. Estimates suggest that as many as 3 to 12 million computers are already infected with Conficker.

Computers that had already been patched with the update that Microsoft released back in October are less likely to catch the worm, but infection is also possible from network shares with weak passwords and removable storage devices.

Once infected, the worm disables access to antivirus vendor and security software sites. As we suggest above, there is still a lot that is unknown as far as the full potential of Conficker and what the end game of this worm could be. In the meantime, we suggest that you update your antivirus software and keep it current and check to make sure you are not infected by using the Conficker Eye Chart here.
Last modified on 09 April 2009
Rate this item
(0 votes)