'Code Red' Continues to Spread

ByABC News
August 1, 2001, 10:54 AM

N E W   Y O R K, Aug. 1 -- The Code Red computer worm has been rapidly tunneling its way around the globe today, but the FBI is hopeful that it will not cause extensive problems.

"Based on preliminary analysis, we expect a level of worm activity comparable to the July 19th Code Red infection, which resulted in infection of over 250,000 systems," says a statement released by the FBI's National Infrastructure Protection Center (NIPC) today. The statement adds that Code Red figures to "achieve that level of activity by this afternoon."

David Moore, a senior researcher at the Cooperative Association for Internet Data Analysis in San Diego estimated that nearly 130,000 computer systems around the world had been infected with the worm, as of 8 p.m. ET.

However, Moore said that the rate of infection slowed down as the day wore on.

"It actually seems to be reaching the part where it starts to level off," explains Moore "It does look like it's slowing down. And, it's getting close to infecting everyone who can be infected."

Chad Dougherty, an Internet security analyst at Carnegie Mellon University's CERT Coordination Center in Pittsburgh, said the rapid proliferation of Code Red this morning was because "The worm [was] in the first phase of its attack cycle."

Dougherty also says he is expecting "a level of worm activity comparable to the July 19th Code Red infection."

The White House Web site, the original target of the first Code Red attack last month, has been unaffected by the worm, and there have been relatively few reports of disturbances in Internet traffic due to Code Red.

"We have been monitoring it closely," White House spokesman Ari Fleischer told reporters earlier today. "At this time there has been no impact on the White House."

How to protect your computer from Code Red

First Surfaced July 19

The Code Red worm, which on July 19 first infiltrated thousands of computer systems carrying Microsoft's Windows 2000, Windows NT or Internet Information Server version 4.0 or 5.0, was programmed to attack government Web sites Tuesday evening.