Conficker worm gets an upgrade

By

The Conficker worm, which infected large numbers of PCs last month, has received an upgrade which makes it much more effective.

The Conficker worm, which infected large numbers of PCs last month, has received an upgrade which makes it much more effective.


The new worm, dubbed Conficker B++, has been redesigned to get around attempts to shut it down. Previous variants checked for software update from a list of 250 randomly generated URLs.

However security companies managed to reverse engineer the algorithm that generated the URLs and design a way to block the software from updating. The new variant instead uses a new set of backdoors to update itself.

“We’ve discovered that the new variant no longer patches netapi32.dll against all attempts to exploit it. Instead it now checks for a specific pattern in the incoming shellcode and for a URL to an updated payload,” said Microsoft in an advisory.

“The payload only executes if it is successfully validated by the malware. However, there doesn’t appear to be an easy way for the authors to upgrade the existing Conficker network to the new variant.”

The author of the Conficker worm is still at large, despite a $250,000 bounty offered by Microsoft for information on his identity.

Got a news tip for our journalists? Share it with us anonymously here.
Copyright ©v3.co.uk
Tags:

Most Read Articles

Travel eSIMs secretly route traffic over Chinese and undisclosed networks: study

Travel eSIMs secretly route traffic over Chinese and undisclosed networks: study

Greater Western Water's billing system data issues laid bare

Greater Western Water's billing system data issues laid bare

Microsoft plans full quantum-resistant cryptography transition by 2033

Microsoft plans full quantum-resistant cryptography transition by 2033

Attackers weaponise Linux file names as malware vectors

Attackers weaponise Linux file names as malware vectors

Log In

  |  Forgot your password?