TOKYO – Network worms are shutting down computers running Microsoft’s Windows 2000 operating system, including those at cable news station CNN, television network ABC and The New York Times.
Trend Micro blames the havoc on various worms, including the Zotob worm that hit the Internet over the weekend and new variants of the Rbot worm, CNET.Com reported.
All of the worms exploit a security hole in the plug-and-play feature in the Windows 2000 operating system. Microsoft offered a fix for the bug as part of its monthly patching cycle last week. The software maker deemed the issue “critical,” its most serious rating. Symptoms of infection include the repeated shutdown and rebooting of a computer, Trend Micro said.
Microsoft is investigating the reports of the worm outbreak, the company said in a statement. It lists “Worm_Rbot.CEQ,” an Rbot variant, as the possible cause of the trouble.
Inside job
The multiple worms are hitting individual organizations rather than computer users at large, said Johannes Ullrich, chief research officer at the SANS Institute, an Internet security training and research outfit.
“These worms are not having an impact on the Internet,” Ullrich said. “They do have a substantial effect on organizations running Windows 2000 without last week’s Microsoft patch installed.”
The pain is being felt “on the inside,” agreed David Cole, the director of product management at Symantec Security Response. The worms might slither onto the networks of companies with Windows 2000 systems from an infected laptop that has been used outside the corporate firewall, for example, he said.
The New York Times has been hit by the virus, but the assault has not impacted the delivery of the news, said a spokeswoman for the publication.
Walt Disney’s ABC News and Time Warner’s CNN confirmed in postings to their Web sites that their computers had been hit.
The security issue exploited by the worm also affects the newer Windows XP and Windows Server 2003, but only PCs running Windows 2000 are susceptible to a remote attack, Microsoft has said.
Trend Micro has rated the worm attack “yellow,” which is in the middle of its alert range. The security company has seen thousands of infections from Zotob alone. Infected machines can be cleaned up using tools available from antivirus software makers, including Symantec. Windows 2000 users who have not patched, should do so, Microsoft urges.
