August 19, 2005

Purdue erects successful barriers against system-crashing worm

WEST LAFAYETTE, Ind. — The ZOTOB virus, which quickly spread worldwide this week to infect hundreds of computer systems, including at media giant CNN, was neutralized at Purdue University.

The worm works by copying itself into the Windows system folder. Once in the system folder, the virus prevents the computer from getting online assistance from antivirus Web sites. Based on its recent efforts to counteract previous worms like Blaster, Purdue cybersecurity teams were able to block the entry points ZOTOB uses to invade a network.

"We've made great efforts in preventing infection from external sources," said Gregory Hedrick, manager of security services at Information Technology at Purdue. "The recent improvements in security across the university has helped lesson the impact."

ZOTOB gives hackers remote control over affected systems which can then be used to infect other machines and slow down network performance. Hedrick said the university has updated its antiviral software and begun to apply patches over security holes more quickly. He gives credit to the thousands of computer users on campus who use and also frequently update antivirus software on their individual machines. That allows viruses to be quarantined and deleted more quickly.

As many as 188 of the several thousand computers at Purdue were infected. A source of infection may have been laptops that were infected when used off campus. By Wednesday (Aug. 17) evening, the number of affected computers dropped to 14.

"As a direct result of the increased focus on security, we were prepared," said Scott Ksander, a Purdue inforensics expert whose specialty is tracking down the source and means of cybercriminal activity. "Unlike others being reported in the media, we had defenses in place and were not heavily impacted."

Writer: Jim Schenke, (765) 494-6262, jschenke@purdue.edu

Sources: Gregory Hedrick, (765) 494-1875, hedrick@purdue.edu

Scott Ksander, (765) 49-68289, ksander@purdue.edu

Purdue News Service: (765) 494-2096; purduenews@purdue.edu

To the News Service home page