Monday, August 19, 2003
Los Angeles Times
New Computer Virus Clogs E-Mail Inboxes

From Associated Press/Dow Jones

NEW YORK -- A new strain of one of the most virulent e-mail viruses ever spread quickly worldwide this morning, causing fresh annoyance to users worn out by last week's outbreak of the Blaster worm.

The new virus, named "Sobig.F" by computer security companies, attacks Windows users via e-mail and file-sharing networks. It also deposits a Trojan horse, or hacker back door, that can be used to turn victims' PCs into senders of spam e-mail.

MessageLabs Inc., a company that filters e-mail for corporations, had blocked more than 100,000 copies of Sobig.F by midday, making it by far the most active virus of the day.

"It's definitely spreading very quickly, just an incredible ramp-up so far this morning," said Brian Czarny, marketing director at MessageLabs. The variant is likely to be one of the more successful versions of a very successful virus strain, he said.

The previous Sobig.A and Sobig.B variants are both on MessageLabs' list of the biggest 10 e-mail viruses of all time.

The e-mail message that carries Sobig.F has the subject line "Re: Details" and the message "Please see attached file for details." If a recipient clicks on the attachment, which can have multiple names ending in the .pif file extension, the computer will be infected.

The virus will then send itself out to names found in the victim's address book and will use one of these names to forge a return address. As such, the infected party may not quickly learn of the infection, while an innocent party may get the blame for helping to propagate it.

Like all the other Sobig viruses, this version is programmed to self-destruct after two weeks, in this case on Sept. 10.

The Blaster worm is still at large. It uses a published flaw in Microsoft's Windows operating systems to spread via network connections, without using e-mail. It slowed down the Internet and caused computer restarts worldwide, but the attack it was programmed to carry out against a Microsoft Web site on Saturday proved harmless.

Call it the Battle of the Internet Worms.

As the Blaster worm on Monday began its second week infecting computers, a variant emerged that exploits the same software vulnerability to invade PCs running Microsoft Corp.'s Windows operating system.

But instead of causing mischief, the new worm tries to disinfect machines carrying Blaster and then plug the hole that let both worms through.

In a final act of selflessness, the worm is programmed to delete itself Jan. 1.

The author of the vigilante worm — known by various names, including Nachi — is anonymous.

"There's a little bit of good Samaritan in them," said virus researcher Craig Schmugar of Network Associates Inc., one of several virus-fighting companies that warned of the noble worm after its discovery early Monday.

Those warnings were issued because any worm, no matter how well intentioned, spreads without authorization into private networks. And Nachi can harm some machines.

A company in Japan, where Nachi was spreading quickly, reported that its network crashed when many of its personal computers got the fix-it worm and tried to download Microsoft's Blaster patch simultaneously.

Nachi works only on machines running English, Chinese and Korean versions of Windows. And it tries to download patches only for Windows 2000 and Windows XP, said Joe Hartmann, director of North American anti-virus research at Trend Micro Inc.

Finally, Windows 2000 computers can utilize the patch only if an earlier update has been installed. The worm doesn't seem to know that, Hartmann said.

"It wanted to be a good worm" but fell short, he said.

Although Blaster's spread is slowing, it still is moving faster than Nachi and less good-natured variants, including one that installs a "back door" for future access by hackers.

All take advantage of a security hole discovered a month ago and publicized by Microsoft.

The malicious worms, designed to spread automatically, can trigger constant rebooting, giving users little time to fix infected machines. Blaster was designed to launch a coordinated attack on a Microsoft Web site, but it failed to disrupt much of the Internet because Microsoft disabled the target page.

As with earlier "good" worms that sought to stop Code Red and other Internet infections, Nachi may spur debate about whether an automatic inoculation is the best answer for the failure of many computer users to install fixes when new problems are discovered.

But security experts said the risks of such efforts were still too great. "There could be unwanted side effects," Schmugar said.

Microsoft has been under fire for security lapses, but spokesman Sean Sundwall said it had nothing to do with Nachi.

Click Image for Larger View
 

E-mail :  Brunardot@Brunardot.com