KEY POINTS:
Most of ministry without internet as IT gurus battle worm infection raging around the world
Most of the Ministry of Health is still without internet access after a virus believed to have been caused by a computer "worm" attacked millions of systems around the world.
United States software protection firm F-Secure said the worm, known as "Conficker" or "Downadup", had infected more than nine million computers by Tuesday and was spreading at a rate of one million machines a day.
The malicious software had yet to do any noticeable damage, prompting debate as to whether it is impotent, waiting to detonate, or a test run by cybercriminals intent on profiting from the weakness in the future.
The ministry said the worm was identified in its computer servers early this month.
Health services to the public had not been affected, and yesterday the ministry was close to completely removing the infection.
"This has been a smart piece of software, which has required a huge amount of work to get under control and remove," said ministry spokesman Alan Hesketh. "Significant software updates have been carried out on all of the ministry's 2000-odd PCs and servers."
Internet access was still unavailable for the majority of staff yesterday.
"We're being a bit paranoid - it's imperative the worm is completely eradicated from all ministry systems before internet access is restored. If not, the worm is likely to update itself and that'll be a significant setback."
US software security specialist David Perry of Trend Micro said it was "possibly the biggest virus we have ever seen".
"I think the bad guys are field testing a new technology. If Conficker proves to work well, they could go out and sell malware [malicious software] to people. There is a huge market for selling criminal malware."
The worm, a self-replicating program, takes advantage of networks or computers that haven't kept up to date with security patches for Windows RPC Server Service.
It can infect machines from the internet or by hiding on USB memory sticks carrying data from one computer to another. Once in a computer it digs deep, setting up defences that make it hard to extract.
Malware could be triggered to steal data or turn control of infected computers over to hackers amassing "zombie" machines into "botnet" armies.
"Here we are with a big, big outbreak and they keep revamping their methodology to increase the size of it," Mr Perry said. "They could be growing this huge botnet to slice it up and sell it on the criminal market."
Microsoft has modified its free Malicious Software Removal Tool to detect and get rid of infections.
- AGENCIES
