Viruses/Worms News

Bulletproof: Conficker virus just won't go down

Friday, September 25, 2009

A powerful, multi-faceted virus called Conficker is spreading throughout the internet, despite the best efforts of the computer security community.

Experts say that Conficker's persistence stems largely from the fact that it takes aggressive steps to prevent anti-virus programs being run, and rapidly re-infects computers in a variety of ways. Infected external drives, for example, can spread Conficker to every computer they connect to, and the worm can quickly infect entire networks once it takes root.

Infected machines are at the mercy of Conficker's controllers, as yet unknown, who can use it to obtain personal financial information, a la the Clampi Trojan, or weave groups of infected machines into botnets for use in large-scale distributed denial-of-service attacks on websites. Microsoft has offered a $250,000 reward for information leading to the arrest and conviction of Conficker's creators.

The usual method for destroying a botnet is to target the server used to issue commands to infected computers. But experts say that the server than controls Conficker changes daily and uses highly advanced cryptography, making it almost impossible for security professionals to access. As yet, none have.