911 virus fears exaggerated

Although the feared 911 virus has caused some localised damage in the US, it represents little real threat to UK users, according to security experts.

The virus, actually a worm, takes its name from the fact that it forces an infected PC's modem to dial 911 - the US equivalent of 999 - and then erases the computer's hard drive. The FBI posted a warning about it on 1 April.

Unlike a virus, 911 isn't downloaded from the internet in an infected file. Instead, it jumps directly from PC to PC on the internet by scanning for open shared drives in Windows. It calls 911 one out of five times, and erases the hard drive on a trigger date, reported to be the 19th of the month.

Sans Institute, a co-operative of security professionals and system administrators, announced that sites in Houston and San Francisco suffered damage last week.

Security experts Network Associates has classed 911 as "low risk", though it has upgraded its VirusScan product to detect it. "We are not getting any reported cases, and I've heard nothing here in the UK at all," said Jack Clark, European anti-virus product manager for the company. "My advice to users is to make sure you are using anti-virus software and to keep it up to date," he added.

The International Computer Security Association (ICSA) confirmed that the risk was minimal, and that basic protection would prevent infection. "We think the risk of getting nailed by this thing is pretty low, but the concept of the threat represents something important. People should either turn off sharing or modify it to include passwords," an ICSA spokesman told a US newsgroup.This story has been republished from the 13 April issue of Computing UK.