File-Killing Worm Causes Little Damage

(CBS/AP)  One Italian city's government shut down its computers as a precaution but a file-destroying computer worm otherwise caused relatively little damage when it triggered worldwide Friday.

Hundreds of thousands of computers were believed to be infected, but many companies and individuals had time to clean up their machines this week after security vendors and media outlets warned of the "Kama Sutra" worm.

"It's been pretty quiet," said Mikko Hypponen, chief research officer for Finnish security company F-Secure Corp. "We know the word is out there."

In Milan, Italy, technicians switched off 10,000 city government computers after discovering the infection Thursday and deciding they didn't have enough time to clean the machines before the worm would began wreaking havoc on Friday.

"It has spread to all our computers," said Giancarlo Martella, Milan's councilman for technological innovation and public services. "Knowing how destructive it is, we turned off all personal computers to avoid losing our data."

Only the municipality's registry office had been kept open because its "passive terminals" don't store data, Martella said, adding he hoped the computers would return to normal by Monday.

Experts had warned earlier that the worm, also known as "CME-24," "BlackWorm," or "Mywife.E," could corrupt documents using the most common file types, including ".doc," ".pdf," and ".zip." The worm, nicknamed after the Hindu love manual Kama Sutra because of the pornographic come-ons in e-mails spreading it, affects most versions of Microsoft Corp.'s Windows operating system, prompting the software giant to issue a warning Tuesday.

---

CBS News technology consultant Larry Magid talks with security experts Vincent Weafer of Symantec and David Perry of TrendMicro about the latest worm to infect PCs.

---

It can have a variety of subject lines or messages, reports CBSNews.com technology analyst Larry Magid. Subject lines could include "Hot Movie," "Arab sex," "give me a kiss" or "Fwd: Crazy illegal Sex!" but others are also possible.

And "unlike many of the threats we've heard about lately, there doesn't appear to be any financial motivation," Magid says.

Although the worm tries to disable anti-virus software, vendors have generally posted updates that should protect users. Assuming the computer's internal clock is correct, users can also avoid the worm by leaving their machines off until Saturday, although the worm is set to trigger again on March 3.

Security vendors Trend Micro Inc. and CA Inc. both assessed the overall risk and distribution as low. The worm wasn't expected to spread any more quickly Friday. Rather, Friday was the first trigger date for the file-destroying code.

• 1
• 2
• Next Page »