Conficker.E to self-destruct on May 5th?

Meanwhile Conficker.C is on fraudware spree

The evolution of the multi-faceted Conficker worm is expected to take another turn this May 5th when the latest version, Conficker.E, will simply self-destruct on infected machines, say a number of security researchers.

F-Secure, Trend Micro and SecureWorks are among those that believe Conficker.E--first spotted just this April and probably created by the same attackers that since last fall let loose the Conficker.A through Conficker.C variants--has been designed to simply self-detonate on May 5th.

"It will simply self-destruct," says Mikko Hypponen, chief research officer at F-Secure, pointing out that researchers, who had been arguing over name for variants, agreed to skip past the name "Conficker.D" entirely to settle on the name "Conficker.E."

But even if Conficker.E does simply self-destruct as expected, that still leaves millions of Windows-based computers around the work infected with Conficker.C, which has become active this month in terms of beginning to try and lure victims to fake anti-virus sites--some dub it "fraudware"--to get victims to pay US$50 or so to get rid of Conficker.C.

"We're starting to see some revenue generation," said Phillip Porras, program director in the computer sciences laboratory at SRI International, in a presentation he gave today at the RSA Conference here concerning Conficker. "We're starting to see some business models come out of it."

Security researchers in industry and government are using various means to monitor Conficker.C behavior (which can block over 114 legitimate anti-virus sites and now works in conjunction with the botnet Waledec).

Porras said Conficker.C is involved in an elaborate process to sell fake anti-malware software. When it gets into infected machines, it can direct victims toward Web sites believed to be selling fraudware.

One of those sites appears to be registered in the Ukraine selling the SpywareProtect portfolio, associated with "Ukraine Bastion Trade Group," for example, he said. But Conficker was not necessarily created by this group and researchers are still in the dark about who originates and controls the complex Conficker command-and-control system.

Despite the efforts of the Conficker Working Group, a group which now has 300 experts from industry and government dedicated to do what they can to identity the source of Conficker and stop it, efforts so far have not been successful.

"They've gotten around blocks to shut it down," said Porras, noting the complexity of the Conficker effort suggests a gang, rather than one individual, sharing expertise.

As for the anticipated self-destruction of the Conficker.E variant, researchers say there are strange aspects of it.

"Conficker.E has two parts of it," says Joe Stewart, director of malware research at SecureWorks, describing it basically as breaking up what were earlier combined functions of scanning/spreading and getting downloads, such as through peer-to-peer rendezvous.

But Conficker.E, seen only since mid-April, never seemed to work that well--which was a surprise to researchers since the upgrade path so far for Conficker has been quite impressive technically.

"Some of the functionality in .E doesn't work," says Stewart. Conficker.E, he says, may be a new anti-malware attempt that simply wasn't good enough, or it may be a deliberate "distraction" by attackers to throw a little dust in the eyes of researchers. "They may be working on a more advanced version," says Stewart.

No one besides the Conficker attackers seems to know what will come next, but most researchers see financial gain to clearly be its use at present.

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags malwaref-secureconficker

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Ellen Messmer

Network World
Show Comments

Cool Tech

Toys for Boys

Family Friendly

Stocking Stuffer

SmartLens - Clip on Phone Camera Lens Set of 3

Learn more >

Christmas Gift Guide

Click for more ›

Brand Post

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Aysha Strobbe

Microsoft Office 365/HP Spectre x360

Microsoft Office continues to make a student’s life that little bit easier by offering reliable, easy to use, time-saving functionality, while continuing to develop new features that further enhance what is already a formidable collection of applications

Michael Hargreaves

Microsoft Office 365/Dell XPS 15 2-in-1

I’d recommend a Dell XPS 15 2-in-1 and the new Windows 10 to anyone who needs to get serious work done (before you kick back on your couch with your favourite Netflix show.)

Maryellen Rose George

Brother PT-P750W

It’s useful for office tasks as well as pragmatic labelling of equipment and storage – just don’t get too excited and label everything in sight!

Cathy Giles

Brother MFC-L8900CDW

The Brother MFC-L8900CDW is an absolute stand out. I struggle to fault it.

Luke Hill

MSI GT75 TITAN

I need power and lots of it. As a Front End Web developer anything less just won’t cut it which is why the MSI GT75 is an outstanding laptop for me. It’s a sleek and futuristic looking, high quality, beast that has a touch of sci-fi flare about it.

Emily Tyson

MSI GE63 Raider

If you’re looking to invest in your next work horse laptop for work or home use, you can’t go wrong with the MSI GE63.

Featured Content

Product Launch Showcase

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?