Windows worms knocking out computers
By Joris Evers
http://news.com.com/Windows+worms+knocking+out+computers/2100-7349_3-5835530.html
Story last modified Tue Aug 16 15:43:00 PDT 2005
Network worms are shutting down computers running Microsoft's Windows 2000 operating system, security experts warned Tuesday.
Computers across the United States are being hit, including those at cable news station CNN, television network ABC and The New York Times. The Tokyo-based antivirus company blames the havoc on various worms, including the Zotob worm that hit the Internet over the weekend and new variants of the Rbot worm.
All of the worms exploit a security hole in the plug-and-play feature in the Windows 2000 operating system. Microsoft offered a fix for the bug as part of its monthly patching cycle last week. The software maker deemed the issue "critical," its most serious rating.
"It seems like every couple of minutes a new variant comes in. We cannot pinpoint the infections to one variant," said Joe Hartmann, director of antivirus research group at Trend Micro. "We are still gathering infection reports. It is coming globally."
Symptoms of infection include the repeated shutdown and rebooting of a computer, Trend Micro said.
The security company has rated the worm attack "yellow," which is in the middle of its alert range. Trend Micro has seen thousands of infections from Zotob alone, Hartmann said.
Microsoft is investigating the reports of the worm outbreak, the company said in a statement. It lists "Worm_Rbot.CEQ," an Rbot variant, as the possible cause of the trouble.
The onslaught of worms based on the plug-and-play flaw appeared less than a week after Microsoft's patch release, leaving users very little time to protect their systems.
In the crosshairs
The New York Times has been hit by the virus, but it has not impacted the delivery of the news, said a representative for the publication.
"The Web site was not affected and newspaper production will not be affected," the representative said. The internal systems of the paper are "operational," the representative added, but did not state what degree of impact the worm had had on its internal operations.
Walt Disney's ABC News and Time Warner's CNN confirmed in postings to their Web sites that their computers had been hit.
Experts have different opinions on the cause of the latest infections. The SANS Internet Storm Center, which tracks network threats, attributes Tuesday's trouble to Zotob, which keeps mutating and finding new victims. "As seen with prior TCP worms, it is reaching its peak around three days after the outbreak," SANS said on its Web site.
The security issue exploited by the worm also affects the newer Windows XP and Windows Server 2003, but only PCs running Windows 2000 are susceptible to a remote attack, Microsoft has said.
There are desktop and server versions of Windows 2000, which was released in 2000 for business users rather than consumers. More recent editions of Windows are available, but Windows 2000 remains popular. The operating system ran on 48 percent of business PCs during the first quarter of 2005, according to a recent study by AssetMetrix.
CNET News.com's Michael Kanellos contributed to this report.
