[an error occurred while processing this directive]
BBC News
watch One-Minute World News
Last Updated: Thursday, 18 August 2005, 09:45 GMT 10:45 UK
Windows 2000 bug starts virus war
A Boeing jet under construction, AP
Aircraft maker Boeing was hit by the Windows 2000 bug
A war has broken out between hackers behind viruses that exploit a recently discovered loophole in Windows 2000.

The viruses written by the competing hacker groups are fighting it out for supremacy on infected machines.

Some of the variants seek out and delete rival viruses they find on machines they manage to penetrate.

The slew of malicious programs exploiting the loophole caused trouble for many organisations early this week as the bugs began infecting computers.

War zone

A patch for the vulnerability being exploited by the 11 viruses turned out by the rival groups was released on 9 August and code to exploit it appeared only a few days later. The weakness occurs in the Plug-and-Play component of Windows 2000.

The loophole also affects PCs running Windows XP unless users have installed a security update. The flaw can also be fixed by a patch for Windows 2000.

Separate virus writing groups have used the exploit code to create malicious programs. Earlier this week organisations including the Financial Times, heavy plant maker Caterpillar, ABC News and CNN reported that they had been hit by the viruses.

PLUG-AND-PLAY BUGS
Zotob.A, B, C
IRCbot.ES, ET, EX
Bozori.A, B
Rbot.YN
SDbot.ADB
Codbot
Although Windows 2000 is the most prevalent version of the operating system used in large organisations, Microsoft said the number of firms infected was relatively low.

The software giant has released a free tool to automatically remove the Zotob worm and its variants from infected PCs.

Now newer versions of the viruses have been created that try to destroy bugs from rival groups, reported security firms Clearswift and F-Secure.

"We seem to have a botwar on our hands," said Mikko Hypponen, chief research officer at F-Secure.

"There appears to be three different virus-writing gangs turning out new worms at an alarming rate," said Mr Hypponen, "as if they were competing to build the biggest network of infected machines."

Variants of the Bozori and IRCbot viruses that exploit the Windows 2000 loophole will delete some of the Zotob, RDbot and SDbot virus programs if they find them on machines they manage to compromise.

Microsoft urged users to turn on auto-updates and make sure anti-virus and other security programs were up to date.

"Our analysis has revealed that the reported worms are variants of the existing worm called Zotob," said the company in a statement.

"Microsoft is working closely with law enforcement to help identify and bring to justice those responsible for this malicious activity."



SEE ALSO:
Windows 2000 worm hits US firms
17 Aug 05 |  Technology
Tools drive point-and-click crime
15 Aug 05 |  Technology
Have hackers recruited your PC?
17 Mar 05 |  Technology
Virus flood threatens home users
13 Jun 05 |  Technology
Rise of zombie PCs 'threatens UK'
22 Mar 05 |  Technology
Hackers to the honey
31 Jul 01 |  Science/Nature


RELATED INTERNET LINKS:
The BBC is not responsible for the content of external internet sites


PRODUCTS AND SERVICES

Americas Africa Europe Middle East South Asia Asia Pacific