Conficker worm gets an upgrade

The Conficker worm, which infected large numbers of PCs last month, has received an upgrade which makes it much more effective.

The new worm, dubbed Conficker B++, has been redesigned to get around attempts to shut it down. Previous variants checked for software update from a list of 250 randomly generated URLs.

However security companies managed to reverse engineer the algorithm that generated the URLs and design a way to block the software from updating. The new variant instead uses a new set of backdoors to update itself.

“We’ve discovered that the new variant no longer patches netapi32.dll against all attempts to exploit it. Instead it now checks for a specific pattern in the incoming shellcode and for a URL to an updated payload,” said Microsoft in an advisory.

“The payload only executes if it is successfully validated by the malware. However, there doesn’t appear to be an easy way for the authors to upgrade the existing Conficker network to the new variant.”

The author of the Conficker worm is still at large, despite a $250,000 bounty offered by Microsoft for information on his identity.