The Conficker worm is showing signs of life a week later than expected, but experts aren’t quite sure what it’s doing, the BBC reports. The program, believed to be on millions of PCs worldwide, began updating itself last night, downloading encrypted software, researchers at Trend Micro found. The worm’s peer-to-peer communications are “now running in full swing,” warned a tech blogger.
To keep things quiet, the update’s spread will be gradual, the BBC says. Once it’s on a machine, it checks that its host is still connected to the Internet, then removes evidence that it’s been installed. Its encryption has prevented experts from deducing exactly what Conficker will do, but they expect it to be able to pull data such as bank log-in information.