Windows Virus Hits Harvard Computers

A virus designed to exploit a security vulnerability in Windows operating systems has been spreading rapidly through computers on the Harvard network since Monday evening, according to Coordinator of Residential Computing Kevin S. Davis ’98.

The worm—a specific type of virus written to propagate as quickly as possible—is known as the W32.Lovesan or W32.Blaster and was first noticed on campus on Monday. It makes itself known on a computer by displaying error messages and forcing a machine to shut down.

“I would be hard pressed to rememeber another virus that has created this much of a stir this quickly,” Davis said. “Just walking around the Science Center, you couldn’t walk past a group of people talking and hear them talking about anything but the virus.”

Davis said this virus did not require a user to download and run a file for a computer to become infected.

“It wouldn’t be related to any file you’ve downloaded,” he said. “All you have to do is be plugged into the network to get it.”

Davis said that there was no way to calculate how many Harvard computers had been attacked by the bug and said different estimates around the country have suggested a total of anywhere from “the low hundreds of thousands into low millions.”

He said research firms had analyzed the virus and determined that its ultimate goal was to mount an attack on Microsoft’s corporate headquarters itself, beginning on Saturday. That would mean that all individual computers who had been compromised with the virus would simultaneously try to break into the site containing all of Windows’ updates, including new software and patches.

The virus spread quickly. Davis said that several hours after the virus was discovered on Monday, it had hit Harvard’s network.

He said no instances of damage had been reported as of the time of the interview—only annoyance at the frequent shutdowns—but that the risk is there.

“There’s no reason somebody can’t write a variant to this program that would steal your credit card numbers or other information that you have stored on your computer,” Davis said.

Harvard Arts and Sciences Computer Services now provides a repair tool on its website, composed of patches released by Microsoft to repair the weakness and a cleaning tool to remove the virus from a computer.

“It’s certainly kept us extremely busy,” Davis said. “For Tuesday and Wednesday, everyone who was calling in was calling about this.”

He said the best way to protect a computer was through the use of firewalls such as those built into Windows XP, and to keep one’s system updated with patches and other fixes provided by Microsoft.

—Staff writer Laura L. Krug can be reached at krug@fas.harvard.edu.