"Conficker.E has two parts of it," says Joe Stewart, director of malware research at SecureWorks, describing it basically as breaking up what were earlier combined functions of scanning/spreading and getting downloads, such as through peer-to-peer rendezvous.

But Conficker.E, seen only since mid-April, never seemed to work that well--which was a surprise to researchers since the upgrade path so far for Conficker has been quite impressive technically.

"Some of the functionality in .E doesn't work," says Stewart. Conficker.E, he says, may be a new anti-malware attempt that simply wasn't good enough, or it may be a deliberate "distraction" by attackers to throw a little dust in the eyes of researchers. "They may be working on a more advanced version," says Stewart.

No one besides the Conficker attackers seems to know what will come next, but most researchers see financial gain to clearly be its use at present.