Yikes! Conflicker Worm....It's Alive!

[3113]

Apparently it is awake and doing something:

The Conficker worm is finally doing something - updating via peer-to-peer between infected computers and dropping a mystery payload on infected computers, Trend Micro said on Wednesday. Researchers were analyzing the code of the software that is being dropped onto infected computers but suspect that it is a keystroke logger or some other program designed to steal sensitive data off the machine, said David Perry, global director of security education at Trend Micro.

The software appeared to be a .sys component hiding behind a rootkit, which is software that is designed to hide the fact that a computer has been compromised, according to Trend Micro. The software is heavily encrypted, which makes code analysis difficult, the researchers said. The worm also tries to connect to MySpace.com, MSN.com, eBay.com, CNN.com and AOL.com as a way to test that the computer has Internet connectivity, deletes all traces of itself in the host machine, and is set to shut down on May 3, according to the TrendLabs Malware Blog.

Because infected computers are receiving the new component in a staggered manner rather than all at once there should be no disruption to the Web sites the computers visit, said Paul Ferguson, advanced threats researcher for Trend Micro. "After May 3, it shuts down and won't do any replication," Perry said. However, infected computers could still be remotely controlled to do something else, he added.

Rest of the story here.

 

[impressive]

That's just creepy.

 

[DesertPirate]

From Slashdot

http://it.slashdot.org/article.pl?sid=09/04/09/1213204&art_pos=9

"Conficker seems to finally be doing something, a week after hype around the worm peaked on April Fool's Day. It has now downloaded components from the Waledac botnet, which could contain rootkit capabilities. Trend Micro security expert Rik Ferguson said: 'These components have so far been missing, but could this finally be the "other boot dropping" that we have all been been waiting for?' Ferguson also suggested that people behind Conficker could be the very same who are running Waledac and created the Storm botnet. 'It tallies with some of the assumptions people have made about Conficker — that the first variant was actively trying to avoid the Ukraine because Waledac was Eastern European,' Ferguson added."

 

[voluptuary_manque]

Apparently it is awake and doing something:

But not on Safari. Oh, good. I don't go to any of those sites, anyway.

 

[glynndah]

eBay? Oh, boy! Maybe my husband will stay away for a while. After all, seven saxophones is more than enough for one person.

 

[voluptuary_manque]

That's like a friend of mine who went to Africa and shot six warthogs . . .