The "activation" of Windows machines infected with the latest variant of the Conficker worm has allowed security watchers to come up with a far more accurate estimate of how many machines are infected.

Early versions of Conficker called home to 250 different domain names every day to check for updates. Since Wednesday, machines infected by with the latest version of the worm (Conficker-C) began using a sample of 500 out of pre-programmed 50,000 domains a day to search for upgrades.

The unknown virus writers who created the worm are yet to publish any such update, but the call-back behaviour has allowed anti-virus firms to come up with an estimate of how many machines are infected by Conficker-C for the first time.

Vietnamese antivirus firm Bkis reckons 1.3m machines are infected with Conficker-C. A breakdown of infections by country, compiled by Bkis, can be found here. The combined number of computers infected by Conficker A and B is 2.2m, according to Bkis.

That total of around 3.5m is in line with a detailed technical analysis by Conficker which puts the size of the Conficker botnet at between three and four million strong.

IBM's X-Force has a mash-up using Google Maps or Conficker infections across the world, which can be found here. The Conficker Working Group has published more detailed infection maps here.

Estimates of the number of machines ever infected by Conficker vary from ten to 15 million, but these figures ignored disinfections and other factors. It's more meaningful to talk of the current number of zombie drones rather than the number ever infected, because it gives a much better idea of the potential for harm.

As predicted by security watchers beforehand, Conficker's 1 April "activation" passed by without anything happening, much like previous malware trigger dates associated with nuisances such as the Michelangelo virus (1992), CIH (1999), SoBig (2003), and MyDoom (2004). The unknown authors of Conficker didn't publish updates on 1 April, but since infected machines check for updates on a daily basis it would be wrong to think that the threat has passed. Updates using the P2P mechanism built into the worm are also possible.

F-Secure has compiled an updated, informative FAQ on Conficker here, which cover important questions such as how to tell if you're infected and much more besides. Conficker blocks access to security sites, a factor exploited by Joe Stewart of the Conficker Working Group to create a simple test here. ®

Related stories

• Conficker Group muses on hits and misses (26 January 2011)

  https://www.theregister.com/2011/01/26/conficker_response_assessment/

• Conficker borks London council (4 September 2009)

  https://www.theregister.com/2009/09/04/ealing_council_mystery_malware/

• London hospital recovers from Conficker outbreak (24 August 2009)

  https://www.theregister.com/2009/08/24/nhs_hospital_conficker/

• MyDoom dabs spotted on mega cyberassault (8 July 2009)

  https://www.theregister.com/2009/07/08/mydoom_cyberassault/

• Conficker left Manchester unable to issue traffic tickets (1 July 2009)

  https://www.theregister.com/2009/07/01/conficker_council_infection/

• Conficker: Hold the funeral, it's not dead yet (21 May 2009)

  https://www.theregister.com/2009/05/21/conficker_continued_spread/

• Conficker botnet wake up call only pinged zombie minority (17 April 2009)

  https://www.theregister.com/2009/04/17/conficker_p2p_update/

• One in ten PCs still vulnerable to Conficker exploit (14 April 2009)

  https://www.theregister.com/2009/04/14/conficker_punts_scareware/

• Spam spurt fuelled by booming underground economy (14 April 2009)

  https://www.theregister.com/2009/04/14/symantec_threat_report/

• Conficker botnet stirs to distribute update payload (9 April 2009)

  https://www.theregister.com/2009/04/09/conficker_botnet_update/

• Old worm learns new Conficker tricks (6 April 2009)

  https://www.theregister.com/2009/04/06/old_worm_adopts_conficker_tricks/

• Conficker suspect brought to book in Beavertown? (2 April 2009)

  https://www.theregister.com/2009/04/02/conficker/

• Conficker botnet remains dormant - for now (1 April 2009)

  https://www.theregister.com/2009/04/01/conficker_activation/

• Scareware scammers latch onto Conficker hype (31 March 2009)

  https://www.theregister.com/2009/03/31/conficker_search_scam/

• Busted! Conficker's tell-tale heart uncovered (30 March 2009)

  https://www.theregister.com/2009/03/30/conficker_signature_discovery/

• Leaked memo says Conficker pwns Parliament (27 March 2009)

  https://www.theregister.com/2009/03/27/conficker_parliament_infection/

• Final countdown to Conficker 'activation' begins (26 March 2009)

  https://www.theregister.com/2009/03/26/conficker_activation_analysis/

• Conficker gets upgraded with defenses (7 March 2009)

  https://www.theregister.com/2009/03/07/conficker_upgrade/

• Conficker call-backs threaten to swamp legit domains (2 March 2009)

  https://www.theregister.com/2009/03/02/conficker_collateral_damage/

• Conficker variant dispenses with need to phone home (23 February 2009)

  https://www.theregister.com/2009/02/23/conficker_variant/

• Houston justice system laid low by Conficker worm (9 February 2009)

  https://www.theregister.com/2009/02/09/houston_malware_infection/

• Conficker botnet growth slows at 10m infections (26 January 2009)

  https://www.theregister.com/2009/01/26/conficker_botnet/

• Conficker seizes city's hospital network (20 January 2009)

  https://www.theregister.com/2009/01/20/sheffield_conficker/