April Fools’ Day deadline may be diversion for Conficker virus

The good news is that the Conficker virus probably won’t do anything too damaging when a deadline triggers next week. The bad news is that the network of infected machines has taken another step beyond the reaches of security researchers.

As we’ve noted before, the virus keeps itself updated through a system which generates random domain addresses to contact for further instructions. Security researchers had largely figured out how the system works and how to predict which addresses it will use, but the system covered 250 different addresses each day. This made it impractical to continue with an initial plan to buy up all the possible names before the virus creators.

It’s now known that the virus creators issued two updates through this system which have transformed how the infected machines communicate. They are now linked through an enormous peer-to-peer network meaning each individual computer can now issue instructions to other machines.

The immediate concern is that the updates also instructed the computers to contact 500 different domain addresses a day starting from April 1. To make things even more complicated, these addresses will be picked from a pool of 50,000 possibilities.

Given the peer-to-peer network, the virus no longer needs to contact addresses in this way in order to survive and grow, making the instructions something of a mystery. It’s possible the April 1 trigger will be an intentional denial-of-service attack designed to bring down Web sites. Most likely though, it’s simply a show of force designed to make the network appear even more valuable before Conficker’s creators cash in on their work by selling it on.

Of course, whatever damage the virus actually does or will do, it’s still best to get it off your machine. We’ve had word from a reader that the solution offered by BitDefender has worked, so do check out its free removal tool if you think your machine might be infected.

Talking of that article, we do have a correction. Although we stated the firm had found a way to stop the virus blocking an infected computer from contacting a particular domain (which is how Conficker stopped many anti-virus programs from removing it), this isn’t the case. Instead BitDefender simply found a domain which had not been blocked by the virus, a workaround which thankfully seems to have done the trick.

• 

• Microsoft puts 250k bounty on Conficker virus creators
• Conficker targeting of Southwest Airlines a red herring
• BitDefender claims it has Conficker killer
• Conficker phones home, gets no reply
• Conficker virus authors blamed for Valentine’s scam