Conficker worm gets an upgrade

Conficker has been redesigned to get around attempts to shut it down

The Conficker worm, which infected millions of PCs last month, has received an upgrade which makes it much more effective.

The new variant, dubbed Conficker B++, has been redesigned to get around attempts to shut it down.

Previous versions checked for software updates from a list of 250 randomly generated URLs. But security companies managed to reverse engineer the algorithm that generated the URLs and design a way to block the software from updating. The new variant now uses a new set of backdoors to update itself.

"We have discovered that the new variant no longer patches netapi32.dll against all attempts to exploit it. Instead it now checks for a specific pattern in the incoming shellcode and for a URL to an updated payload," said Microsoft in an advisory.

"The payload only executes if it is successfully validated by the malware. However, there does not appear to be an easy way for the authors to upgrade the existing Conficker network to the new variant."

The author of the Conficker worm is still at large, despite a $250,000 (£175,000) bounty offered by Microsoft for information on his identity.