Conficker worm changes tactics again
A new variant of the Conficker/Downadup worm attempts to con infected users with fake spyware tool
April 11, 2009
The Conficker/Downadup worm continues to evolve, with the release of a new variant of the worm.
The newly detected E variant attempts to update the current C variant, with a number of new features that appear in part to be intended to steal data and to con users.
The latest version installs a fake anti-spyware tool called Spyware Guard 2008 or Spyware Protect 2009 which informs users that their PC has been infected with spyware, and tries to get them to pay $50 for removal.
Researchers have noted that the level of infection has dropped off considerably, with only one or two million PCs still infected, down from a peak of around nine million.
For a vendor-neutral test to see if your PC is infected click here.
