Viruses/Worms News

Conficker worm updated to spread scareware

Friday, April 10, 2009

Web security experts have spotted a new variant of the Conficker computer worm they say has begun downloading additional software on infected PCs, including a new rogue anti virus product.

Experts said the new variant, Conficker.E, is designed to update the .C variant that went live on April 1, rather than the original .A version that first showed up late last year.

Not everyone agrees that the malicious code being detected belongs to Conficker, according to InformationWeek. Some security experts believe the new variant is more closely associated with the Waledac worm.

The Washington Post reported that the .E variant sets up a web server on the infected system that re-enables the worm to spread itself through the Microsoft Windows vulnerability that caused the outbreak.

The update also instructs the Waledac component to remove itself if the date is on or after May 3, 2009, according to security researchers, the Post reported.

One security expert told the Post that the scareware update means the cybercriminals responsible for the worm are getting around to trying to make some money from all of their work.

"There are still some unknowns here, but things are becoming a lot more clear," the expert said, according to the Post. "[I]t certainly seems they're making a move here to finally monetize all this effort."