Porras said Conficker.C is involved in an elaborate process to sell fake anti-malware software. When it gets into infected machines, it can direct victims toward Web sites believed to be selling fraudware.

One of those sites appears to be registered in the Ukraine selling the SpywareProtect portfolio, associated with "Ukraine Bastion Trade Group," for example, he said. But Conficker was not necessarily created by this group and researchers are still in the dark about who originates and controls the complex Conficker command-and-control system.

Despite the efforts of the Conficker Working Group, a group which now has 300 experts from industry and government dedicated to do what they can to identity the source of Conficker and stop it, efforts so far have not been successful.

"They've gotten around blocks to shut it down," said Porras, noting the complexity of the Conficker effort suggests a gang, rather than one individual, sharing expertise.

As for the anticipated self-destruction of the Conficker.E variant, researchers say there are strange aspects of it.