Roanoke Times
Copyright (c) 1995, Landmark Communications, Inc.
DATE: SUNDAY, December 11, 1994 TAG: 9412120043
SECTION: VIRGINIA PAGE: B1 EDITION: METRO
SOURCE: DAN CASEY STAFF WRITER
DATELINE: LENGTH: Medium
A "stealth" computer virus that spreads like chicken pox in a kindergarten class has been found in some of the city's desktop PCs, and officials fear it has contaminated as many as 500 personal computers and thousands of computer diskettes.
Known as "NewBug," the infection has not caused any major problems - yet. But already it's sent city employees scrambling to eradicate it and raised fears of possible data destruction.
"It's been a frustration, I'll tell you that. It's gotten so that I'm halfway paranoid," said city Auditor Bob Bird.
The bug was discovered Thursday morning after Ken Mundy, controller for the city school system, retrieved some accounting diskettes that the city auditor's office had borrowed as part of a routine audit.
Mundy loaded that software on his office computer, which has an automatic virus-detection programt.
He notified Bird, who found the bug on two PCs and at least 30 computer diskettes in his office. Bird believes the bug was put on the accounting diskettes by an already-infected computer in his office.
Bird spent all day Thursday and part of Friday disinfecting two computers and diskettes in his office alone.
"Every office [within the municipal auditor's office] was found to have at least one infected diskette," said Tom Baldwin, Bird's chief deputy.
Meanwhile, the bug was located on another computer in the city's work-station support office. That led to fears that an assistant auditor who has since left the city for another job may have unintentionally infected other computers in the Municipal Building.
Before he resigned, the assistant auditor did a software inventory of every city-owned PC. It's conceivable that each one was infected during the inventory, said Coy Weaver, the city's work-station support administrator.
"We have to jump on it quick and cover the city. It hasn't really gotten into its destructive mode yet," Weaver said.
NewBug struck computers at Carilion Health Systems a few months ago, but the company detected it and got rid of it, said Jill Michaels, a city work-station support specialist.
A virus is a program, usually written by computer hackers, that is designed to reproduce itself and spread from computer to computer. NewBug - a "boot sector" virus -is spread through already-infected disks.
Infection results only when the computer is turned on with the contaminated disk in it, but any clean disk used in an infected computer also would be contaminated. The city owns so many disks it doesn't even know how many it has.
According to a May 1993 article in PC World magazine, more than 5 percent of U.S. companies have experienced virus infections. Total losses are estimated to be as high as $1 billion a year.
Many viruses are innocuous and merely slow a computer or display a cute message. But others, known as "logic bombs," hide on hard disks until a certain date or command is executed. At that point, they can permanently destroy stored files or crash the computer.
The NewBug virus, which is also called AntiExe, D3 or CMOS4, can be one of the more harmful ones. But that is likely only in computers with a very sophisticated setup, like those used by programmers, said Aryeh Goretsky, senior anti-virus support specialist for McAfee Inc. The Santa Clara, Calif.-based company is one of the world's leading developers of anti-virus and network security software for personal computers.
The typical personal computer that is infected with NewBug may have problems running popular programs such as Windows, he said. The virus also will cause problems in formatting diskettes, a function that allows computers to store information on them.
On diskettes with many files, the virus could "corrupt" directories, making it difficult to access information stored on them.
Major problems could occur in computers with hard disks that are partitioned so they can run different operating systems, a setup that is rare except among very computer-proficient workers.
"I have seen damage with this virus, but for the overwhelming majority of people, it's simply going to infect the hard disk and any diskette that is used in the computer," Goretsky said.
The NewBug appeared almost simultaneously in the United States and Europe about six months ago, Goretsky said. Since then, it has spread worldwide.
Although the precise origins are unknown, Goretsky believes it originated in Asia.
"It probably came on a shipment of hardware that was shipped out of Asia. When a virus is distributed like that, it can spread very fast," he said.
Any virus-detection software less than 3 months old can find the virus and eliminate it, Goretsky said.
However, "If [the city] has any problems, they're welcome to call us," he said.
by CNB