• E-mail
• Print
• Comment
• Font Size
• Digg
• del.icio.us
• Discuss article

Feared Attack From Computer Virus Fizzles

Posted on: Friday, 22 August 2003, 06:00 CDT

A feared Internet attack resulting from a fast-spreading computer virus fizzled Friday, as security officials said they contained it by identifying and blocking computers key to coordinating it.

Instructions written into the latest version of the "Sobig" virus, which began appearing Tuesday, called for infected Windows machines to try to download a program that, until the attack began at 3 p.m. EDT Friday, had an unknown function.

Experts feared the program could have deleted files, stolen passwords or created rogue e-mail servers for spreading junk e-mail.

But Vincent Weafer, security director with Symantec Security Response, said that when the appointed time came, all the virus did was visit a pornography site.

"There is nothing malicious, just a standard sex site," he said.

The attack began with the virus attempting to reach one of at least 20 computers, mostly in the United States and Canada, to obtain information key to continuing.

Internet addresses written into the virus point to those computers being home machines connected through broadband services like cable or DSL, said Chris Rouland, vice president for research and development at Internet Security Systems Inc. It was unlikely the machines' owners knew that they were picked as accomplices, he said.

Antivirus experts identified those computers and persuaded their Internet service providers to shut Internet access to some of them.

Within minutes of the attack's beginning, researchers at Network Associates Inc., an antivirus software vendor, were unable to reach any of those computers, said Craig Schmugar, a virus research engineer.

"It looks like this attack is averted," Schmugar said.

Other experts were able to reach only one of the 20.

Infected computers were programmed to keep trying every Friday and Sunday between 3 p.m. and 6 p.m. EDT.

Mikko Hypponen, manager of antivirus research with F-Secure Corp. in Finland, said users should clean their computers using antivirus software - antivirus companies have issued free tools to do so - or turn off machines if they cannot run the disinfecting software.

Users with firewall programs can also block UDP port 8998, which is the Internet opening the virus uses to communicate with the outside world.

Already, Sobig has resulted in e-mail disruptions at several businesses, universities and other institutions. Sobig did not physically damage computers, files or critical data, but it tied up computer and networking resources.

The New York Times asked employees at its headquarters to shut down their computers Friday because of "computing system difficulties." A spokesman declined to discuss the type or scope of the problems, but said that the newspaper will publish a Saturday edition.

Times spokesman Toby Usnik declined to say whether a computer virus might be to blame.

Users get the Sobig virus when they click on attachments to e-mail carrying such subject lines as "Details,""Approved" and "Thank you!"

One e-mail company, MessageLabs Inc., has declared it the fastest e-mail infection ever.

The Sobig outbreak came just one week after a virus known as "LovSan" and "Blaster" took advantage of a flaw in the Windows operating system to clog computer networks around the world. The "Blaster" outbreak has started to subside, experts said.

---

On the Net:

Removal instructions can be found at http://www.f-secure.com

More News in this Category