“The Conficker worm is finally doing something–updating via peer-to-peer between infected [Windows PCs] and dropping a mystery payload on infected computers, Trend Micro said on Wednesday,” Elinor Mills reports for CNET.
“Researchers were analyzing the code of the software that is being dropped onto infected computers but suspect that it is a keystroke logger or some other program designed to steal sensitive data off the machine, said David Perry, global director of security education at Trend Micro,” Mills reports.
“The software appeared to be a .sys component hiding behind a rootkit, which is software that is designed to hide the fact that a computer has been compromised, according to Trend Micro. The software is heavily encrypted, which makes code analysis difficult, the researchers said,” Mills reports.
“On Tuesday night Trend Micro researchers noticed a new file in the Windows Temp folder and a huge encrypted TCP response from a known Conficker P2P IP node hosted in Korea,” Mills reports. “In addition to adding the new propagation functionality, Conficker communicates with servers that are associated with the Waledac family of malware and its Storm botnet, according to a separate blog post by Trend Micro security researcher Rik Ferguson.”
Full article here.
MacDailyNews Take: We attempted to speak with two Windows PC owners who we found in Pasadena exiting a Goodwill Thrift Store and a Day Old Bread Store, respectively. When asked for their opinion on the cost of Windows malware, including antivirus software subscriptions, wasted time, increased frustration, data loss, personal information breaches, and lost productivity vs. the completely unaffected Macintosh platform, “Lauren” and “Giampaolo” just stood there as slack-jawed and dull-eyed as when we first met them, with nothing coming out of their mouths except for thin streams of drool.
