Thursday, September 20, 2001
Computer worm spreads rapidly
'Nimda' infection snarls systems
By James McNair
The Cincinnati Enquirer
Last week came the bombings, this week a stock market sell-off. Now the nation is dealing with a computer worm.
Launched Tuesday by unknown mischief makers, the so-called W32-Nimda worm has imbedded itself in computer networks throughout the United States and in several other countries. Systems at many Greater Cincinnati companies and institutions were infected, forcing computer departments into a daylong chore of ousting the worm and preventing its return.
Every engineer we have is currently in the field after being in the field or on the phone all day yesterday and working into the night, said John Frazer, chief executive of ITSolutions in Madisonville.
The Nimda worm, which affects PCs, poses a threat serious enough that U.S. Attorney General John Ashcroft issued a public warning about it Tuesday. Mr. Ashcroft said there is no evidence linking it to last week's terrorist attacks.
Larger servers that host computer networks and run Microsoft's Internet Information Services software are especially vulnerable to the Nimda worm. Once lodged in a Web site's host computer, it generates enough network congestion to render the system dysfunctional.
Visitors to infected Web sites can become infected themselves merely by browsing. The worm also multiplies by e-mailing itself as an attachment titled readme.exe.
The worm created additional work for information systems employees and independent computer consultants. It struck networks big and small in all parts of the city, including at the Cincinnati Police Department.
About 20 percent of our computers were affected, police spokeswoman Fran Cihon said. But they were the business computers, not those used in law enforcement. There was no loss of data, and the IS team is updating virus scans on all machines to protect the network and prevent the virus from spreading.
Cincinnati Bell also was paid a visit by the Nimda worm.
For a short period of time, we had some difficulty accessing certain records to answer customers' questions about billing or changing their service, said company spokeswoman Tressie Long. We had to resort to taking down their names and calling them back.
The Cincinnati Enquirer's main computer servers are inoculated against viruses and worms, but Nimda made its way into the Associated Press photo servers.
Terri Hovey, the Enquirer's vice president of information technology, said the servers were taken off the network and rebuilt. Meantime, she said, the company suspended network activity on each of its 700-plus computers to install antivirus upgrades. The work fully occupied four employees, she said.
But Nimda is not corrupting or deleting information.
Whoever wrote it had every opportunity in the world to have it do a great deal more damage than it does, Mr. Frazer said. To our knowledge, it doesn't actually go in and delete documents, work product, databases or files.
Airlines slash more jobs
Military news slows Dow spiral
Meal suppliers ready
Pre-terror economy had slowed
Cintas has healthy 1st-quarter sales
Computer worm spreads rapidly
Transport had unusual week
Business Digest
Morning Memo
Tristate Summary
What's the Buzz?