Conficker Infections Number In The Millions

Security company Kaspersky Lab has identified 200,000 unique addresses in Conficker’s peer-to-peer network – but the actual number of nodes affected is far higher.

New research by Kaspersky has re-opened the question of whether Conficker was hyped. While the Conficker worm generated an intense amount of public interest, the number of computers infected with the newest variant of the worm seems to be relatively small.

“While analysing Kido [Conficker] network behaviour we’ve been able to develop an application that helped us to get an in depth insight into the peer-to-peer network communications of the malware, which have been used to distribute updates over the last week,” blogged Georg Wicherski, a virus analyst at the security company. “Over a 24 hour observation period, we’ve been able to identify 200,652 unique IPs participating in the network, far less then initial estimated Kido infection counts.”

However, Kaspersky Lab senior antivirus researcher Roel Schouwenberg noted this is just the number of computers the company detected participating in the P2P network. The total number of infected machines is still in the millions, Schouwenberg told eWEEK.

At various points, vendors have put the number as high as 9 million. Efforts by the security community such as The Conficker Working Group seem to have paid off, but the group still puts the current number of unique IPs infected with variants A, B and C at roughly 3.6 million.

Only a fraction of the nodes infected with earlier variants appear to have been updated, according to Wicherski’s blog post. Kaspersky’s analysis also found that the highest concentrations of infected machines are in Brazil, China and the eastern part of the United States, which is reminiscent of similar findings from IBM’s X-Force earlier this month.

The latest iteration of the worm has been tied to a scheme to trick users into downloading rogue anti-virus. There are a number of tools available to help victims remove and detect the malware, as well as a patch for the Microsoft vulnerability targeted by multiple versions of the worm.