Net bug infects banks and airlines

THE Sasser computer virus continued its trail of chaos around the world yesterday, affecting banks, airlines and Government offices.

More than a million computers are thought to have been infected already, with home users expected to be hit hardest.

Victims of the bug include British Airways, the European Commission and the UK Coastguard, where operators had to resort to using pen and paper.

Experts warned that the next target could be the High Street, infecting hole-in-the-wall cash machines and electronic cash registers.

But they said it was impossible to be sure how widespread the infection was - or will become - because the bug does not rely on email to move around but spreads directly through the internet.

Home users are particularly vulnerable because they often lack the sophisticated 'firewall' and anti-virus protection software used by most companies.

Those with broadband - where the computer is connected to the internet all the time - should be especially wary, say experts.

Graham Cluley, of anti-virus software firm Sophos, said: 'We believe there will have been millions of computers which Sasser has tried to infect. We know that if you take an unprotected computer, without any software protection against viruses, and plug it into the internet it will probably be infected within a couple of minutes.'

Sasser is the fastest spreading virus since the Sobig.F worm last August, he said. Its wildfire spread has caught many off-guard, particularly companies with staff who use work computers out of the office.

Many laptops became infected at employees' homes - where they lack anti-virus protection - over the weekend.

Among those affected were banks, travel booking systems and Britain's 19 Coastguard stations. A spokesman for the UK Maritime and Coastguard service said: 'We've had to go back to plotting on paper charts rather than using the computer mapping system.'

At British Airways, 21 flights were delayed as half of the company's 16,000 computers were found to be infected.

US carrier Delta Air Lines also suffered a computer glitch on Saturday, causing delays and cancellations, although the company was unsure whether Sasser was the culprit.

Other victims include investment bank Goldman Sachs, Australia's Westpac Bank, Finnish financial company Sampo and government departments in Hong Kong.

Sasser targets a flaw in certain versions of the Windows 2000 and Windows XP operating systems, as well as Windows Server 2003 software.

Unlike previous internet worms, it infects vulnerable PCs without any action by the user, such as opening attachments, allowing it to spread very quickly.

The first the individual or company knows is when an error message appears on the screen or the computer slows down or reboots itself.

However, the worm also uses computers to try to infect other machines or lies dormant, waiting for extra information to be sent.

Microsoft has urged users to download a 'patch' from its website which prevents such attacks. The worm looks for computers without the patch and will download without the user being aware.

Security experts are now analysing Sasser to determine where it might hit next.

Raimund Genes, European president of security software firm Trend Micro, said: 'We don't know yet, for example, if it attacks machines running on Windows XP Embedded, which runs ATM machines and cash registers. That would be disastrous for banks and retailers.'

The FBI and Microsoft are working together to track down the author of the virus before more versions of Sasser can be unleashed.

How to stop the worm

How do I prevent Sasser infecting my computer?

SASSER exploits a loophole in versions of the Microsoft operating systems Windows XP and Windows 2000.

If you are running these systems on your PC, you need to go on to the Microsoft website and download a small program which will plug the loophole.

This program, called a 'patch', is available free of charge. Instructions are on the Microsoft website, at

www.microsoft.com/security/

Microsoft has urged users to ensure they set their computer to automatically download any patches it issues.

If you have anti-virus software, you should keep it updated to ensure it can combat the latest viruses roaming the internet. Updates are available from the website of the company which designed the software.

Users are also advised to install a protective 'firewall' on to their computer. A firewall is an add-on which polices the boundaries of any computer or network.

How do I know if my computer is already infected?

AN error message is displayed. Typically, the machine will repeatedly crash or re-start itself. It may also become very slow.

What do I do to get rid of it?

MICROSOFT and many security firms are offering free software tools on their websites which diagnose whether your machine is infected.

These tools will then be able to 'clean up' your computer and rid it of the Sasser program.

Among the anti- virus companies offering such tools are:

www.trendmicro-europe.com www.sophos.com

You should then install the patch from Microsoft, as described above, to stop your machine becoming re-infected.