Conficker Stirs, updates and installs payload
Comment | Print | Email to a Friend | Font Size: AAConficker, the bug that failed to impress anyone on April 1st has been seen to stir.
According to TrendMicro Conficker updated itself through P2P and dropped a payload similar to a keylogger on all of the systems infected. At the same time it appeared that the software was checking internet connectivity by hitting sites like MSN, MySpace and a couple of others.
To make matters more interesting it seems that Conficker may shut down on May 3rd. This is not confirmed and even if it is true the Worm could be reactivated at any time.
One more item of concern is that Conficker appears to talk to the Storm and Waldec Malware family.
Read more at CNet.
The software appeared to be a .sys component hiding behind a rootkit, which is software that is designed to hide the fact that a computer has been compromised, according to Trend Micro. The software is heavily encrypted, which makes code analysis difficult, the researchers said.
The worm also tries to connect to MySpace.com, MSN.com, eBay.com, CNN.com and AOL.com as a way to test that the computer has Internet connectivity, deletes all traces of itself in the host machine, and is set to shut down on May 3, according to the TrendLabs Malware Blog.
Related Tags
Further Reading: Read and find more news at our news index page.
Do you get our news RSS feed? Get It! Got a news tip? Tell Us!