Tweet
Net infection spreading
By TED BRIDIS
STOCKHOLM, Sweden (AP) -- Computers mysteriously restarted and tens of thousands of people lost Internet access as a virus-like network infection spread Tuesday in Europe and Asia.
Security officials said the Internet worm, dubbed "LovSan," was part of a coordinated electronic attack that exploited a serious flaw in Microsoft Corp.'s Windows operating systems.
The worm was first reported Monday in the United States and, while appearing not to delete files or otherwise incur permanent damage, knocked many computers offline.
Across Asia and Europe, it struck many businesses as they opened and workers logged on, spreading without the need for user intervention.
Graham Cluley, a senior technology consultant with Sophos PLC in Britain, said his company started getting reports about the infection from Australia and then in Europe.
The virus was "highly spread" across Germany, said Michael Dickopf, a spokesman at the Federal Office for Security in Computer Technology, adding that the office had received several calls from companies that were suffering problems.
A server at the offices of automaker BMW was downed by the virus, spokesman Eckhard Vannieck said. The problems did not affect production and the company expected to have it repaired by the end of the day.
In Sweden, Internet provider TeliaSonera said about 20,000 of its customers were affected after the infection clogged 40 servers that handled Internet traffic. Spokeswoman Lena Rosell said customers had their service restored by late morning.
Internet security company F-secure said about 900 computers in Sweden were infected by LovSan.
Computers infected by LovSan were programmed to automatically launch an attack Saturday on windowsupdate.com, a Web site Microsoft uses to avail customers of software patches that can prevent such infections.
Microsoft had posted a free patch on the Web site to protect Windows users after it warned on July 16 about one of the most serious flaws ever discovered in its flagship Windows operating system.
Nearly all versions of Windows are affected.
The high-profile alerts issued by Microsoft notwithstanding, many businesses did not initially install the patches and scrambled Tuesday to shore up their computers.
"People are too laid back. Microsoft doesn't do these warnings for fun," said Cluley. "I think a lot of people have gotten into the habit of thinking viruses only come in via e-mails."
S.C. Leung, spokesman for the Hong Kong Computer Emergency Response Team Coordination Center, said some home computers crashed, possibly a side effect of the infection, also dubbed "blaster."
Individual users and small businesses appeared to be at greater risk than bigger companies, which typically have thorough firewalls that can stem such attacks. But once such a worm gets inside a firewall, unprotected computers are vulnerable.
South Korea's Information and Communication Ministry said that about 1,900 cases of the infection were reported there.
"The situation is slowly calming down, but we are still getting fresh reports of infections," said Cho Kyu-il, a ministry official.
In Denmark, the effects of the attack were limited, but rising.
"The tendency is rising and we're getting more reports of attacks," said Preben Andersen, head of Denmark's official virus watchdog agency, DK CERT. "There must be at least a couple of thousand PCs infected with this worm (in Denmark)."
In Italy, Barbara Paramatti of Microsoft said numerous complaints had come from private customers who probably didn't have the software to prevent the virus. No companies using Microsoft products had complained, she said.
By TED BRIDIS
STOCKHOLM, Sweden (AP) -- Computers mysteriously restarted and tens of thousands of people lost Internet access as a virus-like network infection spread Tuesday in Europe and Asia.
Security officials said the Internet worm, dubbed "LovSan," was part of a coordinated electronic attack that exploited a serious flaw in Microsoft Corp.'s Windows operating systems.
The worm was first reported Monday in the United States and, while appearing not to delete files or otherwise incur permanent damage, knocked many computers offline.
Across Asia and Europe, it struck many businesses as they opened and workers logged on, spreading without the need for user intervention.
Graham Cluley, a senior technology consultant with Sophos PLC in Britain, said his company started getting reports about the infection from Australia and then in Europe.
The virus was "highly spread" across Germany, said Michael Dickopf, a spokesman at the Federal Office for Security in Computer Technology, adding that the office had received several calls from companies that were suffering problems.
A server at the offices of automaker BMW was downed by the virus, spokesman Eckhard Vannieck said. The problems did not affect production and the company expected to have it repaired by the end of the day.
In Sweden, Internet provider TeliaSonera said about 20,000 of its customers were affected after the infection clogged 40 servers that handled Internet traffic. Spokeswoman Lena Rosell said customers had their service restored by late morning.
Internet security company F-secure said about 900 computers in Sweden were infected by LovSan.
Computers infected by LovSan were programmed to automatically launch an attack Saturday on windowsupdate.com, a Web site Microsoft uses to avail customers of software patches that can prevent such infections.
Microsoft had posted a free patch on the Web site to protect Windows users after it warned on July 16 about one of the most serious flaws ever discovered in its flagship Windows operating system.
Nearly all versions of Windows are affected.
The high-profile alerts issued by Microsoft notwithstanding, many businesses did not initially install the patches and scrambled Tuesday to shore up their computers.
"People are too laid back. Microsoft doesn't do these warnings for fun," said Cluley. "I think a lot of people have gotten into the habit of thinking viruses only come in via e-mails."
S.C. Leung, spokesman for the Hong Kong Computer Emergency Response Team Coordination Center, said some home computers crashed, possibly a side effect of the infection, also dubbed "blaster."
Individual users and small businesses appeared to be at greater risk than bigger companies, which typically have thorough firewalls that can stem such attacks. But once such a worm gets inside a firewall, unprotected computers are vulnerable.
South Korea's Information and Communication Ministry said that about 1,900 cases of the infection were reported there.
"The situation is slowly calming down, but we are still getting fresh reports of infections," said Cho Kyu-il, a ministry official.
In Denmark, the effects of the attack were limited, but rising.
"The tendency is rising and we're getting more reports of attacks," said Preben Andersen, head of Denmark's official virus watchdog agency, DK CERT. "There must be at least a couple of thousand PCs infected with this worm (in Denmark)."
In Italy, Barbara Paramatti of Microsoft said numerous complaints had come from private customers who probably didn't have the software to prevent the virus. No companies using Microsoft products had complained, she said.
Comment