US: Vexing computer worm to evolve on April Fool's Day
29 Mar 2009 3:13 PM
SAN FRANCISCO, March 29 AFP - A tenacious computer worm which has wriggled its way onto machines worldwide is set to evolve on April Fool's Day, becoming harder to exterminate but not expected to wreak havoc.
A task force assembled by Microsoft has been working to stamp out the worm, referred to as Conficker or DownAdUP, and the US software colossus has placed a bounty of $US250,000 ($A354,962) on the heads of those responsible for the threat.
The worm is programmed to modify itself on Wednesday to become harder to stop, according to Trend Micro threat researcher Paul Ferguson, who is part of the Conficker task force.
"There is no evidence of it going into attack mode or dropping any particular payload on April 1st," Ferguson said in an interview.
"What people controlling the botnet are doing is building in survivability because of efforts by the good guys to lessen the harm of this thing."
The worm, a self-replicating program, takes advantage of networks or computers that haven't kept up to date with security patches for Windows RPC Server Service.
It can infect machines from the Internet or by hiding on USB memory sticks carrying data from one computer to another. Once in a computer it digs deep, setting up defences that make it hard to extract.
Malware could be triggered to steal data or turn control of infected computers over to hackers amassing "zombie" machines into "botnet" armies.
A troubling aspect of Conficker is that it harnesses computing power of a botnet to crack passwords.
Microsoft has modified its free Malicious Software Removal Tool to detect and get rid of Conficker.
"As this threat continues to evolve, Microsoft and other collaborative companies will continue to identify new ways to disrupt the Conficker threat to give customers more time to update their systems," said Christopher Budd, security response communication lead for Microsoft.
Computer users are advised to stay current on anti-virus tools and Windows updates, and to protect computers and files with strong passwords.
Conficker is programmed to reach out to 250 websites daily to download commands from its masters.
