Fri Apr 24, 2009 3:04pm EDT

By Jim Finkle

BOSTON (Reuters) - A malicious software program known as Conficker that many feared would wreak havoc on April 1 is slowly being activated, weeks after being dismissed as a false alarm, security experts said.

Conficker, also known as Downadup or Kido, is quietly turning an unknown number of personal computers into servers of e-mail spam, they added.

The worm started spreading late last year, infecting millions of computers and turning them into "slaves" that respond to commands sent from a remote server that effectively controls an army of computers known as a botnet.

Its unidentified creators started using those machines for criminal purposes in recent weeks by loading more malicious software onto a small percentage of computers under their control, said Vincent Weafer, a vice president with Symantec Security Response, the research arm of the world's largest security software maker, Symantec Corp.

Continued @ Reuters

Conficker.E to self-destruct on May 5th?
By Ellen Messmer , Network World , 04/24/2009

The evolution of the multi-faceted Conficker worm is expected to take another turn this May 5th when the latest version, Conficker.E, will simply self-destruct on infected machines, say a number of security researchers.

F-Secure, Trend Micro and SecureWorks are among those that believe Conficker.E—first spotted just this April and probably created by the same attackers that since last fall let loose the Conficker.A through Conficker.C variants—has been designed to simply self-detonate on May 5th.

Information Security for Database Professionals: View now“It will simply self-destruct,” says Mikko Hypponen, chief research officer at F-Secure, pointing out that researchers, who had been arguing over name for variants, agreed to skip past the name “Conficker.D” entirely to settle on the name “Conficker.E.”

But even if Conficker.E does simply self-destruct as expected, that still leaves millions of Windows-based computers around the work infected with Conficker.C, which has become active this month in terms of beginning to try and lure victims to fake anti-virus sites—some dub it “fraudware”—to get victims to pay $50 or so to get rid of Conficker.C.

Contineud @ Network World