The Conficker worm, which infected millions of PCs last month, has received an upgrade which makes it much more effective.
The new variant, dubbed Conficker B++, has been redesigned to get around attempts to shut it down.
Previous versions checked for software updates from a list of 250 randomly generated URLs. But security companies managed to reverse engineer the algorithm that generated the URLs and design a way to block the software from updating. The new variant now uses a new set of backdoors to update itself.
"We have discovered that the new variant no longer patches netapi32.dll against all attempts to exploit it. Instead it now checks for a specific pattern in the incoming shellcode and for a URL to an updated payload," said Microsoft in an advisory.
"The payload only executes if it is successfully validated by the malware. However, there does not appear to be an easy way for the authors to upgrade the existing Conficker network to the new variant."
The author of the Conficker worm is still at large, despite a $250,000 (£175,000) bounty offered by Microsoft for information on his identity.
Geoengineering on the sea floor near glaciers would form a new ice shelf to prevent melting
Alterations in capillary blood flow can be caused by body position change
Curiosity rover is in 'normal mode' but not transmitting scientific data back to base
NatWest outage comes a day after Barclays' IT systems shut out customers and staff