RealGM

Experts said computer hackers largely have moved away from showboating and causing random trouble. They now usually try to make money off their viral programs.

DeBolt said Conficker C imbeds itself deep in the computer where it is difficult to track. The program, for instance, stops Windows from conducting automatic updates that could prevent the malware from causing damage.

The program's code is also written to evolve over time and its author appears to be making updates to thwart some of the Conficker Cabal's attempts to neuter the worm.

"It is very much a cat and mouse game," DeBolt said.

It's unclear who wrote the program, but members of the Cabal are looking for clues.

First, they know that some recent malware programs have come from Eastern European countries outside the jurisdiction of the European Union, said Patrick Morganelli, senior vice president of technology for Enigma Software.

Worm program authors often hide in those countries to stay out of sight from law enforcement, he said.

In a way, the Conficker Cabal is also looking for the program author's fingerprints. DeBolt said security researchers are looking through old malware programs to see if their programming styles are similar to that of Conficker C.

The prospects for catching the program's author are not good, Morganelli said.

"Unless they open their mouth, they'll never be found," he said.

So, the most effective counter-assault simply may be damage control.

One quick way to see if your computer has been infected is to see if you have gotten automatic updates from Windows in March. If so, your computer likely is fine, DeBolt said.

At some point on April 1, the Conficker virus, which has quietly infected millions of PCs worldwide to herd them into a "botnet" of linked machines, will phone home for new instructions.

What it'll do next is anyone's guess. It could muster enough silicon firepower to take down any Web site on the planet, or send out enough spam to fill the inboxes of every e-mail user on Earth.

It could offer itself up to the highest bidder, mostly likely an Eastern European cybercriminal. Or it could do what it's been doing for months — nothing.

moofs wrote:It's possible to do "research" on CNN and Fox?
Isn't that like researching Greek society through Ovid?

p.s. BitDefender has a detection/removal tool available.