Worm Infects Harvard Network

The Sasser.B computer worm swept across the Harvard network and the world this weekend, disrupting classes and frustrating both staff and students.

Unleashed last Friday, Sasser.B is a new version of an old worm. This new worm is transmitted directly from the internet. It does not spread through e-mail or attachments and requires no user intervention to spread.

It is the third major virus epidemic this year, following Mydoom in January and Bagle.J in February. Sasser is transmitted much faster than any of these and is not detected by such virus scan programs as McAfee and Norton.

The anti-virus company Symantec claims that by yesterday afternoon, over 10,000 computers worldwide were infected by Sasser. But many computer service websites placed the estimate closer to 100,000 machines. Companies in Finland, Taiwan, Australia and the United States were initially hardest-hit by the virus.

Computers running Windows 2000 or XP are vulnerable until they receive the Microsoft virus update download, available to Harvard staff and students on the Faculty of Arts and Sciences Computer Services (FASCS) website. Macs and earlier versions of Windows are safe.

Kevin S. Davis ’98, the director of residential computing, said nearly 28 percent of the computers on the Harvard network are vulnerable.

“It is a safe assumption that a high number of those are probably infected,” he said.

The worm taxes the computer’s memory, forcing it to reboot endlessly. It does not damage the hard drive, however. Davis said the worm is more of an annoyance than a serious threat. The fear, though, is that it might provide an open gateway for more pernicious viruses to enter.

Edward S. Segel ’06 was one of many to find his computer infected yesterday afternoon, when he first noticed the symptoms.

“A window pops up that says, ‘Your computer will shut down in 45 seconds,’ and then it turns off,” he said. The same window reappears 10 seconds after the computer reboots.

Once a computer is infected, Harvard disconnects it from the network. Segel, who was attempting to fix the problem on his own, said he was frustrated after being cut off from the network.

“My internet was disabled, but all the solutions and patches I need are online. How am I supposed to download a patch, if my internet is disconnected?” he said.

A powerpoint presentation in a lecture for Astronomy 1, “An Astronomical Universe,” was disrupted when the professor’s laptop continually rebooted.

Davis strongly encourages all students and staff running Windows 2000 or XP to download the patch from the FASCS website.

The Student Help Desk had increased traffic yesterday because of Sasser. Their voicemail encourages students whose computers are displaying the symptoms to follow the directions on their website, rather than trying to book an appointment. Some students said that while seeking assistance from User Assistants, they were told they would have to wait until Thursday.