D
djbaxter
Guest
Conficker's domain routine has already started
by Patrik, F-Secure.com
Tuesday, March 31, 2009
...more
by Patrik, F-Secure.com
Tuesday, March 31, 2009
Mikko posted earlier about how the domain generation algorithm in Conficker (aka Downadup) works. Just to make it clear to everyone - this has now started.
Infected computers use the local time as the trigger of when to start generating the list of 50,000 domains so in places where the local time is already April 1st, these computers are now actively polling for domains.
And, until the GMT date is April 1st they are in fact polling for domains for 31st March. So far there hasn't been any updates available on those sites.
In summary: Conficker has activated. So far nothing has actually happened.
...more