bodyType

customContents

entityId

entityUuid

articlePageQuery

filter

article

articleBaseAdvertisingInfoArticle

articleListArticle

articleSeoArticle

hooksArticleAcknowledgementGateOverlayArticle

hooksTrackPageViewArticle

hooksContentInterestArticle

articleLinkingDataContent

hooksAmpRedirectArticle

articleSchemaContent

liveArticle

advertZone

sentiment

contentLock

topics

types

sections

paywallTypes

createdDate

publishedDate

urlAlias

moreOnThisArticles

sponsorType

commentCount

authorLocations

authors

corrections

displaySlideShow

multimediaEmbed

printHeadline

seriesContainer

articleSpeeches

socialHeadline

headline

images

flag

firstTopic

glossary

flattenTypeIds

image

relatedLinks

relatedNewsletters

__typename

sponsor

pdfFiles

seriesReverseOrder

series

disableOffPlatformContent

published

updatedDate

summary

subHeadline

body

keywords

readingTime

customTimezone

liveContents

SCMP Reporter

The virus' rate of infection has decreased, but 923 cases were reported in HK within a five-day span

Hong Kong avoided the worst of a fast-spreading computer virus attack last week. The virus threatened to infect millions of computers worldwide and to close a Microsoft website offering software patches against malicious programs.

Various anti-virus experts reported that the rate of infection of the ''Blaster'' worm has decreased, despite the discovery of two new variants and another virus - called the ''Graybird'' Trojan - that disguises itself as software to stop Blaster.

There were 923 incidents reported to the Hong Kong Computer Emergency Response Team Co-ordination Centre, part of the Productivity Council, as of 11am Saturday since the outbreak was first recorded in the territory last Tuesday.

Reports to the centre represented more than 5,600 personal computers getting infected, while other local anti-virus specialists estimated a much higher figure - up to 15,000 machines.

Estimates of global infections also varied among organisations  tracking them.

Network Associates, which supplies McAfee anti-virus software, reported more than 1.2 million systems infected worldwide as of Saturday.

Internet security specialist Symantec, meanwhile, reported that 4.04 million systems were infected as of the weekend. Akamai Technologies, a service provider that  manages  e-business systems, said the hardest-hit market was North America with 45 per cent of infections, Europe accounted for 27 per cent, Asia-Pacific 24 per cent and South America 4 per cent.

Estimates of financial loss attributed to the Blaster worm have so far not been made.

Some US$2.6 billion in losses is credited to the 'Code Red' virus spread in 2001 and $1 billion in damages was wrought by the 'Slammer' worm earlier this year.

The Blaster worm goes by different names, depending on the anti-virus software vendor tracking it. Computer Associates calls it Win32/Poza, while Symantec calls it Win32.Blaster. McAfee refers to it as W32/Lovesan and F-Secure calls it W32/Msblast.A.

Kondia Kan, technical consultant at anti-virus software vendor Trend Micro, said  Blaster  bears the shoddy craftsmanship of an amateur virus writer and that there was a patch available from Microsoft more than a month ago.

'What we can expect is more attacks from more amateur virus writers,' Ms Kan said.

She noted that the Blaster worm exploits a known security flaw in Microsoft's Windows XP, NT and 2000 operating systems.

It distributes itself via the internet by attacking vulnerable computers that have not been patched against a security hole reported by Microsoft last month.

The Blaster variants, W32.Blaster.B and W32.Blaster.C, function identically as the original, differing in renaming the executable file to Penis.exe and Teekids.exe respectively.

The Graybird Trojan, meanwhile, propagates itself by being attached to e-mails claiming to be a patch from Microsoft to stop the Blaster worm.

Microsoft's Windowsupdate.com site had been targeted by Blaster to suffer a denial-of-service attack, which would use streams of data from infected computers to overload the site's server and close it down to any other traffic.

The software giant Windowsupdate.com to head off the attack. Consumers can update their computers against Blaster by visiting the newly created http://windows update.microsoft.com or go to www.microsoft.com.



Blaster disaster averted