'Little cause for alarm' over 911 internet worm

The apocalyptic 911 'virus' represents little real threat to UK users.

The virus, actually a worm, takes its name from the fact that it forces an infected PC's modem to dial 911, the US equivalent of 999, and then erases the computer's hard drive. The FBI posted a warning about it on 1 April.

Unlike a virus, 911 isn't downloaded from the internet in an infected file. Instead, it jumps directly from PC to PC on the internet by scanning for open shared drives in Windows. It calls 911 one out of five times, and erases the hard drive on a trigger date, reported to be the 19th of the month.

Sans Institute, a co-operative of security professionals and system administrators, announced that sites in Houston and San Francisco suffered damage last week.

Security expert Network Associates has classed 911 as 'low risk', though it has upgraded its VirusScan product to detect it.

"We are not getting any reported cases, and I've heard nothing here in the UK at all," said Jack Clark, European product manager for anti-virus at Network Associates.

"My advice to users is to make sure you are using anti-virus software and to keep it up to date."

The International Computer Security Association (ICSA) confirmed that the risk was minimal, and that basic protection would prevent infection.

"We think the risk of getting nailed by this thing is pretty low, but the concept of the threat represents something important. People should either turn off sharing or modify it to include passwords," an ICSA spokesman told a US newsgroup.