experts are advising computer owners to upgrade their browsers and be on the
alert for what could be one of the most devastating cyber worms ever to attack
know their systems are infected by the worm.whboy if their executable file
icons turn into images of pandas with burning joss sticks. [Photo:
Hundreds, perhaps thousands, of computers in Shanghai have been infected
along with millions of machines in China, the United States and Europe,
according to estimates by security experts.
The cyber bug, called worm.whboy because it originated in Wuhan, China,
received the first five-star severity rating ever issued by the Shanghai
Information Technology Service Center because it can attack local area networks
in government bureaus and companies and damage their programs and databases.
So far, it has infected only Chinese-language Windows-based operating systems
on computers that have logged onto infected Websites.
The Shanghai center received more than 20 calls about the worm on Monday from
companies and government bureaus. Each caller represented a LAN, which can link
hundreds, even thousands, of computers, according to Wang Hao, a center
"We rated the worm at the top-level because of its serious potential for
widespread damage," Wang said. "The most dangerous computer worms last year were
Mydoom and its variations. But they were rated 'four-star' as they mainly
targeted individual users."
The new worm can also prevent infected computers from operating antivirus
software and any programs using the "exe" suffix.
Users will know their systems are infected if their executable file icons
turn into images of pandas with burning joss sticks.
Beijing Jiangmin Science Co, an Internet security firm, called the worm a
"Our enterprise emergency hotline rang without interruption today, mainly
with calls from Guangdong Province and Shanghai," a Jiangmin official said on
The official estimated "several million" people may be affected by the worm.
Computers in more than 1,000 firms, mostly multinationals, have been infected
already, according to Kingsoft Corp, a Beijing-base anti-virus firm.
Cyber security firms and the National Computer Virus Emergency Response
Center said that special downloads to fix infected computers are available on
antivirus Websites, including www.jiangmin.com and tool.duba.net.
To protect against the worm, experts advised computer users not to open
unknown links. They were also urged to raise the security level of their
Internet browsers to at least medium and change their Windows entry passwords.