Expert Says "Code Red" Worm not Made in China

"Code Red" Worm not Made in China

---

A Chinese computer virus expert said on Tuesday the fast-spreading "Code Red" Internet worm which disrupted US government Web sites last week was not made in China, despite Web site defacings that said "Hacked by Chinese."

The worm, which US officials said was likely to start multiplying again on Tuesday and could slow the Internet worldwide, had surfaced little in China, experts said.

"One thing I can be sure of is that it was not created by a Chinese person. Its appearance and its spreading did not start in China," said Wang Jianfeng, assistant manager of technical support at Ruixing Computer Development Co, a virus protection company in Beijing.

"The virus has had more of an effect in Europe and the United States," Wang said.

Ruixing, which has a global network of monitoring systems, had not received any calls about the worm in China, he said.

Ronald Dick, director of the FBI's National Infrastructure Protection Center (NIPC), said the worm had infected more than 250,000 computer systems on July 19, a day of heavy attacks.

The worm installs itself on server computers which then are instructed to blitz government and other Web sites and can slow them down.

In last week's hits, some US government sites showed the message "Hacked by Chinese," using a popular term for illegally breaking into a computer system.

Little Impact in China

But two of the three known variants of the Code Red worm, named for a caffeine drink favoured by computer programmers, showed no obvious vandalism.

In Hong Kong, the Computer Emergency Response Team, a government-funded body, said it has received two complaints of attack and many queries about the worm since July 20.

CERT is responsible for alerting the public in Hong Kong of computer virus attack.

Hundreds of US Web firms got a taste of Chinese patriotic vandalism when a hacker war flared between Americans and Chinese after an April 1 collision between a US spyplane and a Chinese fighter jet.

Code Red, which first surfaced in mid-July, is expected to re-emerge at 8 pm EDT (2400 GMT) on Tuesday, according to NIPC and other online security watchers.

The virus had virtually no impact in China, according to the government-run Computer Virus Treatment Center in Tianjin, 100 km (60 miles) east of Beijing.

"We haven't received any calls about it," said Liang Hong, a spokeswoman for the centre.

Computers running the Windows NT or Windows 2000 operating systems and Microsoft's Internet Information Server (IIS) software version 4.0 or 5.0 are vulnerable to infection and the users should install a software patch, the NIPC said on Monday.

Computer users running Windows 95, Windows 98 or Windows ME are less vulnerable and no action was recommended for them.

For infected computers, turning the machine off and then on gets rid of the worm but does not provide immunity from future infection.

Print	Discuss It