Computer Virus on the Move

Last night, Conficker -- the computer worm that's had every computer user in a tizzy for weeks -- finally began to show signs of life. What exactly it's doing, no one's quite sure.

• BBC coverage

Here's the scoop: On April 8, Conficker began updating itself via Internet download, a process which became possible on the April 1 launch date. Before April 8, Conficker had been searching for updates but hadn't found any such instructions. Now they are finally being delivered.

What's in those instructions, though, remains a bit of a mystery: The downloaded programs are heavily encrypted, so they can't be analyzed in detail. We do know that, after installation, the instructions we can see are relatively benign: They tell the computer to check one of five random websites -- MySpace, eBay, AOL, CNN, and MSN -- in order to verify the computer has internet access. It then confirms the date and time. More>>

• Solution
• Video

Conficker: Vast Computer Spy Network

WASHINGTON (Reuters) – Canadian researchers have uncovered a vast electronic spying operation that infiltrated computers and stole documents from government and private offices around the world, including those of the Dalai Lama, The New York Times reported on Saturday.

In a report provided to the newspaper, a team from the Munk Center for International Studies in Toronto said at least 1,295 computers in 103 countries had been breached in less than two years by the spy system, which it dubbed GhostNet.

Embassies, foreign ministries, government offices and the Dalai Lama's Tibetan exile centers in India, Brussels, London, and New York were among those infiltrated, said the researchers, who have detected computer espionage in the past. More>>

WHAT TO DO?

• Free patch (and removal tool) at www.Symantec.com
• If you can't log on to Symantec.com, you're infected.
• Contact your ISP or Internet security provider.