W.32Downadup.C, the third variant of the Conficker virus is more aggressive and trying to be stealth by disabling the security software installed on the machine. The new variant is focusing more on how to hide itself than on spreading to more computer. It uses and improved algorithm which generates more than 500,000 random domains per day to download the payload. The previous version generated only 250 per day which was successfully reversed engineered by the Microsoft.

Conficker will try every three hours to connect to specific domains over HTTP (‘phoning home’) however, unlike many other worms which use a static list of domains, Conficker’s domain list is dynamically generated by an algorithm to download the payload. It’s still a mystery that no payload has yet to be delivered by the worm even after having more than 16 million PCs infected world wide.