A computer worm has infected thousands of computers using Shanghai Telecom's broadband services since its outbreak on Tuesday, local anti-virus authority and experts said yesterday.
The worm, called "Worm.Mocbot" (devil wave), breaks down victim computers and disables access to the Internet. It also puts a Trojan program in the computers to remote control and steal crucial information, such as online bank account and password.
"More computers will be affected in the next few days though the peak (of infection) has passed," Wang Hao, an official at the Shanghai Information Technology Service, the city-level anti-virus center, said yesterday.
More than 160 people had reported the infection by 4:30 pm yesterday in Shanghai through the service hotline or e-mail, compared with 200 reports on Tuesday and 400s on Wednesday, Wang told Shanghai Daily.
"Though it is a national worm, Shanghai is one of the most-affected regions," said Wang, who suggested that a hacker from Shanghai University probably may have sent the worm.
The worm Mocbot uses a loophole in the Windows XP operating system, MS06-040, to intrude into personal computers, cause breakdowns and steal personal passwords. The stolen information is automatically sent to a computer server at Shanghai University, Wang said.
Most victims are local personal ADSL users because the computer worm can't intrude into company computer firewalls, according to Yang Jun of the Beijing-based anti-virus firm Kingsoft.
Nationwide 4,700 people, including many from Shanghai, had reported the worm to Kingsoft until yesterday evening.
Microsoft has posted a patch download link for the loophole on its Website and assigned it a level of "critical," the highest in its warning system. Both Shanghai Telecom and the local anti-virus center have advised all ADSL users to download the patch and updated anti-virus software online to suppress the worm.
For those who can't access the Internet, Kingsoft has advised they use other computers to download a special virus-killing program, which is small in size and can be stored in a flash memory disk. They should then copy it on to the victim computers to clean up the worm. Other anti-virus firms, such as Beijing-based Rising, have also put such programs online.
(Shanghai Daily August 18, 2006)
