Some more on Conficker.E

[unixronin]

Via C|Net:  Preliminary analysis of a payload being dropped on Conficker-infected machines.

Researchers were analyzing the code of the software that is being dropped onto infected computers but suspect that it is a keystroke logger or some other program designed to steal sensitive data off the machine, said David Perry, global director of security education at Trend Micro.

The software appeared to be a .sys component hiding behind a rootkit, which is software that is designed to hide the fact that a computer has been compromised, according to Trend Micro.  The software is heavily encrypted, which makes code analysis difficult, the researchers said.

Comments

[hrrunka]

Hmmm... No Windows machines here, but I've noticed a sharp up-turn in the back-scatter from outside hitting ports 135 and 445. They're up by ten or twenty times since April 1st.