Windows Users Battle New Computer Worm
Problems Reported at ABC, CNN, New York Times
SAN FRANCISCO (Aug. 17) - A computer worm unleashed over the weekend infected more computers on Tuesday that run Microsoft operating systems, with Windows 2000 users most seriously affected.
The Zotob worm and several variations of it, known as Rbot.cbq, SDBot.bzh and Zotob.d, infected computers at companies such as ABC, CNN, The Associated Press, The New York Times, and Caterpillar Inc.
The worm is causing the most problems at companies with large, networked computer systems, rather than among individual computer users, said David Perry, a security analyst at Trend Micro Inc., a computer security company.
Caterpillar worked Tuesday to clean up effects from the worm, which disrupted computer operations at several company plants and offices over the weekend, the Peoria Ill.-based heavy equipment maker said. The problem was controlled by Monday afternoon, company spokesman Rusty Dunn said.
A week ago, Microsoft Corp. released a "critical" patch for the vulnerability, which is most severe on Windows 2000 systems. Those computers can be accessed remotely through the operating system's "Plug and Play" hardware detection feature. Protective patches, plus instructions for cleansing infected systems, are available on the company's Web site.
Perry said the worm copies itself and then searches networks for other unprotected machines, causing no damage to data but clogging networks and occasionally rebooting its host computer.
He called the worm's effects "small potatoes" in terms of the potential damage, and anticipated that corporate information technology staffs would quickly neutralize the worms. Additionally, Windows 2000 is more than five years old, and Microsoft has released several new versions of its operating system and security overhauls since then, further limiting the exposure.
"We did not see a widespread or fast spread of this in the first 24 hours," said Debby Fry Wilson, director of Microsoft's Security Response Center. "Over the last 24 hours, we've see variance, where other hackers will take the work and try to unleash a variant of the worm. So the worm continues to take on different forms."
Zotob and its variations can attack a computer without needing to open any software, so some users would be infected without knowing it.
Security company McAfee Inc. rated the worm a "high risk" threat, though rivals generally described the threat as moderate.
Companies that were slow to bolster their systems when Microsoft issued its security alert about the flaw may have left themselves vulnerable to the worm, said David Maynor, a security researcher with Atlanta-based Internet Security Systems Inc.
Maynor said some IT professionals who considered their networks safe because they run Windows XP or 2003 were mistaken. The worms need find only one unprotected computer running Windows 2000 within a network to "gain a foothold" in the system. Once inside, the worm unleashes a payload designed to infect other versions of Windows and this multifaceted approach spreads quickly, he said.
"Think of a typical worm as a knife with one sharp edge," Maynor said. "Think of this worm as a Swiss Army knife."
Windows Server 2003 and Windows XP systems with major security updates are less vulnerable, but still could be affected by certain remote users or those within local systems, the company said
Problems Reported at ABC, CNN, New York Times
SAN FRANCISCO (Aug. 17) - A computer worm unleashed over the weekend infected more computers on Tuesday that run Microsoft operating systems, with Windows 2000 users most seriously affected.
The Zotob worm and several variations of it, known as Rbot.cbq, SDBot.bzh and Zotob.d, infected computers at companies such as ABC, CNN, The Associated Press, The New York Times, and Caterpillar Inc.
The worm is causing the most problems at companies with large, networked computer systems, rather than among individual computer users, said David Perry, a security analyst at Trend Micro Inc., a computer security company.
Caterpillar worked Tuesday to clean up effects from the worm, which disrupted computer operations at several company plants and offices over the weekend, the Peoria Ill.-based heavy equipment maker said. The problem was controlled by Monday afternoon, company spokesman Rusty Dunn said.
A week ago, Microsoft Corp. released a "critical" patch for the vulnerability, which is most severe on Windows 2000 systems. Those computers can be accessed remotely through the operating system's "Plug and Play" hardware detection feature. Protective patches, plus instructions for cleansing infected systems, are available on the company's Web site.
Perry said the worm copies itself and then searches networks for other unprotected machines, causing no damage to data but clogging networks and occasionally rebooting its host computer.
He called the worm's effects "small potatoes" in terms of the potential damage, and anticipated that corporate information technology staffs would quickly neutralize the worms. Additionally, Windows 2000 is more than five years old, and Microsoft has released several new versions of its operating system and security overhauls since then, further limiting the exposure.
"We did not see a widespread or fast spread of this in the first 24 hours," said Debby Fry Wilson, director of Microsoft's Security Response Center. "Over the last 24 hours, we've see variance, where other hackers will take the work and try to unleash a variant of the worm. So the worm continues to take on different forms."
Zotob and its variations can attack a computer without needing to open any software, so some users would be infected without knowing it.
Security company McAfee Inc. rated the worm a "high risk" threat, though rivals generally described the threat as moderate.
Companies that were slow to bolster their systems when Microsoft issued its security alert about the flaw may have left themselves vulnerable to the worm, said David Maynor, a security researcher with Atlanta-based Internet Security Systems Inc.
Maynor said some IT professionals who considered their networks safe because they run Windows XP or 2003 were mistaken. The worms need find only one unprotected computer running Windows 2000 within a network to "gain a foothold" in the system. Once inside, the worm unleashes a payload designed to infect other versions of Windows and this multifaceted approach spreads quickly, he said.
"Think of a typical worm as a knife with one sharp edge," Maynor said. "Think of this worm as a Swiss Army knife."
Windows Server 2003 and Windows XP systems with major security updates are less vulnerable, but still could be affected by certain remote users or those within local systems, the company said
