Skip Links

Conficker Awakens, Starts Scamming

By Ian Paul, PC World
April 10, 2009 11:50 AM ET

PC World - The Conficker worm is back in action and stumping security experts once again. One of the most craftily designed pieces of malware recently got an update and is finally starting to behave like other worms. Here's what's going on:

Conficker, the Internet's No. 1 threat, gets an update
Slideshow: 10 of the Worst Moments in Network Security History

New Marching Orders

On Wednesday, April 8 security firms started seeing some variants of Conficker C, the latest Conficker flavor, receive updates through its encrypted peer-to-peer (P2P) file-sharing functionality. Security Firm Trend Micro reports that the new Conficker instructions came from a server in Korea and the new file was created on April 7, 2009 at 07:41:21. The new update strengthened Conficker's defenses and the new Conficker functions will shut down on May 3, 2009.

Until May 3, the refreshed Conficker will search the Internet for uninfected Windows machines that have not applied the Microsoft MS08-67 security patch. This search-and-infect functionality was turned off in previous Conficker varieties, presumably to control the size of a future botnet. However, it seems Conficker's authors have rethought that strategy and are looking to grow their creation once more. Some Conficker variants are also programmed to infect an unpatched computer, and then once Conficker is in the machine the worm patches up the weakness to keep out other types of malware that capitalize on the same vulnerability.

Once Conficker infects a new machine or gets its refresh, it tries to connect to,,,, and to verify the computer is connected to the Internet.

Conficker's first scam revealed

The new Conficker has also started to exhibit signs of traditional malware. Using one of the oldest tricks in the book, called scareware, the new Conficker C downloads a fake antivirus program called Spyware Protect 2009 (pictured). F-Secure says it's called Spyware Guard 2008. The fake program then delivers a pop-up message telling you that your computer is infected, but for only $49.95 the fake antivirus program can remove the malware. You are then directed to a bogus website where you unwittingly enter all your credit card information and then the criminals are laughing all the way to the bank -- your bank, that is. The scareware scam seems to be coming from a server in the Ukraine, according to the Washington Post.

Conficker: Spambot in disguise?

Conficker, being a tricky little piece of programming, seems to be connected in some way to the Waledac worm -- and Waledac itself is considered to be an update of the Storm Worm. There is no consensus about what Conficker is actually doing, but according to the security firm F-Secure, Conficker is going to a domain known to be associated with Waledac and actually downloading the Waledac worm. Trend Micro, meanwhile, says Conficker is downloading some code from the Waledac domain, but the security firm wants to do further studies before confirming a Conficker-Waledac connection. However, Trend Micro suggests that Conficker may be getting ready to work as a large-scale spamming botnet, a known function of the Waledac worm.

Our Commenting Policies
Latest News
rssRss Feed
View more Latest News