Monday, 23 February 2009

Conficker variant updates abilities

A new variant of conficker/downadup is being seen which according to anti-malware testers is even more of a git than the previous incarnations. The updates routines have been altered to remove the need for hard coded domains to be present and the malware can be updated via a push process. The worm's persistence has already been very hard to combat but after this version gets around the new battle of wits will begin. The botnet creating malware will have several ways of updating itself and will not be tied to a known list of domains - the reason the mutation has been forced onto the writers.
It doesn't look good
:(