As assaults on personal computers remain a problem, the FBI has stepped in to try to find the author of the program.
By Compiled from Times wires
Published August 23, 2003
The fastest-spreading Internet e-mail virus ever continues to cause headaches for corporate and home computer users worldwide, but a secondary Internet attack tied to the virus that was scheduled to launch late Friday failed to materialize.
The virus, called "Sobig.F," has clogged e-mail in-boxes and slowed corporate computer networks around the country since it first appeared earlier this week.
On Friday, code written into the virus was supposed to trigger 20 computer servers around the country to begin downloading an unspecified program from the Internet, causing what security officials feared would be a massive Internet attack. But working with private Internet security companies, federal authorities located the computers and forced Internet service providers to shut them down.
The FBI, meanwhile, has launched an investigation to try to track down the source of the virus.
The virus, which has sent almost 100-million junk e-mails since its discovery this week, was supposed to connect to the 20 server computers in the United States and Canada, prompting them to contact infected personal computers worldwide and have them retrieve and run a program, according to Mikko Hypponen, head of virus research at F-Secure OYJ.
The virus will try to do the same thing every Friday and Sunday until it expires Sept. 10, Stephen Trilling, senior director at Symantec, said on a conference call.
"It's always difficult to predict how these things are going to play out," he said.
Analyzing the code will help the FBI catch the people behind Sobig, spokesman Bill Murray said. The probe is being led by the FBI field office in New Haven, Conn., he said. The Washington Post reported that the FBI and Department of Homeland Security have narrowed their search for the source of the virus. Murray declined to comment on the Post story.
Dave Blumenthal, spokesman for Internet service provider EarthLink Inc., said one of the 20 was a server on its network. The Time Warner Cable network, which operated the server, shut it down well in advance of the expected triggering of the virus, he said.
Sobig, nonetheless, continued to cause headaches for countless e-mail users.
The virus comes via e-mail with subject lines such as "Details Approved," "Thank you" or "That movie." The tricky code comes with its own e-mail program embedded in it. The program seeks out e-mail addresses stored on a computer's hard drive and then sends itself to those other users across the Internet.
Postini Inc., an e-mail virus and "spam" protection company, said it caught about 3.7-million e-mails containing the virus Thursday - about 6 percent of all the e-mails it handled that day. The company said the number of e-mails containing Sobig slowed dramatically Friday but was still by far the fastest-spreading virus of all time.
While the virus doesn't destroy computer files, it can slow computer networks substantially and cause significant headaches for users whose mailboxes get flooded with the unwanted e-mails.
The Nasdaq stock market, for instance, caught 64,000 e-mails that contained the virus, said spokeswoman Melissa Fox. By doing so, it avoided any serious problems.
SunTrust Banks Inc. also got flooded by Sobig e-mails, but they didn't cause any serious operating or transactional problems, spokesman Mike McCoy said.
Sobig has infected networks of FedEx Corp., Starbucks Corp. and AOL Time Warner Inc., and the states of New Jersey, Pennsylvania and North Carolina. National Public Radio was inundated Thursday. The New York Times Co. said computers at its offices in New York City "experienced difficulties" shortly after noon Friday. The company wouldn't say for certain that Sobig was the cause.
EarthLink started filtering out Sobig e-mails from its network Thursday because the network and its customers were getting inundated, Blumenthal said.
"At one point we were getting a couple hundred per second," he said.
America Online, the No. 1 Internet service provider, added a new layer of defenses Friday against Sobig in case of increased activity from the virus, said Nicholas Graham, a spokesman.
AOL blocked 21.6-million e-mails infected with Sobig on Thursday, Graham said.
- Information from Cox News Service and Bloomberg News Service was used in this report.
