Computer worms, virus strike campus

While parents may worry about their children catching a virus on their first excursion from home, some University officials believe their children's computers may be more at risk.

Campus computing staffers are working to alleviate effects of two computer worms and a virus that have wreaked havoc on Microsoft users nationwide this summer.

"On the one hand, it's bad -- since so many viruses have occurred in the past month, they bleed together. But it's also good because people know there's something out there and they need to protect themselves," said Caroline Couture, a senior information technology support specialist in College Housing and Academic Services.

A virus needs a person to open a file, while a worm can spread through a network of its own accord.

The first worm, MS Blaster, was discovered on campus the second week in August, when security officials noticed unusual activity in computer logs, Information Security Officer Dave Millar said.

Approximately 250 machines were infected, he added.

The worm only affects Microsoft operating systems, and versions of Windows 2000, NT, and XP are the most vulnerable, according to Microsoft's company Web site.

The worm works by exploiting a design flaw in the operating system, said Bill Smith, a CHAS information technology support specialist.

Connections to the Internet, called ports, continue to talk to the network when not in use in these operating systems. After the worm identifies these susceptible computers, it overloads the port with fake messages, allowing the worm to gain access to the computer and control future actions, Smith said.

So far, the worm has been used to launch distributed denial of service, or DDOS, attacks, he added. In these attacks, the worm points a group of machines to one server and floods it with useless requests, preventing the computers from doing their work.

Although many people believe their computers can only be infected if they open e-mail attachments, this worm can be contracted simply by plugging the ethernet cable into a computer, Millar said.

Furthermore, users may not necessarily know they have the worm, he said. Although it may cause automatic rebooting and cut and paste problems, many users do not notice a change.

To prevent the worm, Smith said, it is important that students download patches from Microsoft and install Norton AntiVirus, which the University licenses for students.

Unlike MS Blaster, the Welchia worm was originally viewed as a benign worm. It looks for vulnerable machines, then makes it harder for other worms to exploit that flaw.

But "it does just as much harm," Millar said, noting that Welchia leaves a back door that may be used to launch future DDOS attacks and drains network resources. As with MS Blaster, users may not realize they have a problem.

Approximately 20 cases of Welchia have been discovered on campus so far, said Steve Thompson, a security analyst for the Office of Information Security.

Although users may not notice the worms, most spot the SoBig.F virus. Despite the fact that it was initially discovered in January, a new version was released in August, and, as of Tuesday morning, approximately 95 campus computers had been infected.

The virus, which has some worm-like characteristics, forges false sender addresses, so people may believe they are receiving an attachment from someone they know. When users open the file, it sends more junk e-mail -- but this time it targets individuals the user knows, and uses addresses found in the address book and web history.

Although it causes network congestion, it does not destroy individual users' files.

"This could not have happened at a better time," Smith said. He noted officials had an opportunity to train information technology associates -- students available throughout the year for computer assistance in college houses -- and educate incoming students about the problem.

"They're all beginning to taper off," Millar added. "I'm hoping it's as small as possible."

Please note All comments are eligible for publication in The Daily Pennsylvanian.