Conficker worm variant kills security processes

Share this article:

Computer systems that are already infected by the Conficker worm are being pushed a new component that kills protective security processes. In addition, the worm's authors have moved from a 250-a-day domain-generation algorithm to a new one that generates 50,000 domain names every day.

The new version of the worm, also known as Downadup, is being called W32.Downadup.C, and is considered a response to the successful cracking of the W32.Downadup.B worm, according to a post by Peter Coogan on the Symantec Security Response blog.

There is no indication that the new component is designed to spread the worm's infection, just to make it difficult for researchers to counteract on the 10 million machines already infected. Coogan wrote that the worm “does not seem to be using any existing or new means to spread the threat to new machines.”

“These early findings may suggest that the Downadup authors are now aiming for increasing the longevity of the existing Downadup threat on infected machines,” Coogan wrote. “Instead of trying to infect further systems, they seem to be protecting currently infected Downadup machines from antivirus software and remediation.”

The list of security processes that the component attacks include some popular security tools, including wireshark, procmon, tcpview, and regmon. Any processes found on an infected machine that contain such antivirus or security analysis tool strings are killed, according to Symantec.


 

Share this article:
close

Next Article in News

Sign up to our newsletters

More in News

Hackers target video game companies to lift copy protections and develop cheats

A threat group is targeting video game companies in order to lift DRM protections, develop cheats and possibly to steal source code.

Android malware spreads via mail tracking SMS spam

The mobile malware is currently targeting German users, McAfee revealed.

About 2,800 victims of worldwide info-stealing campaign targeting various sectors

About 2,800 victims of worldwide info-stealing campaign targeting ...

Unknown attackers have claimed about 2,800 victims in an ongoing information-stealing campaign identified by Kaspersky Lab as "Crouching Yeti."