Computer infection troubles China

By CNN's Rose Tang in Hong Kong

BEIJING, China (CNN) -- An outbreak of the damaging computer infection Code Red has prompted China's Public Security Ministry to issue an urgent warning to computer operators.

Code Red, along with Code Red II and III, have found their way into China and interrupted operations of some government departments and enterprises, China's state media reported.

The Public Security Ministry, which fights computer virus infections, has urged all enterprises and government agencies to establish emergency systems for computer worm attacks.

Code Red origin

RESOURCES Message Board'Code Red' worm

As recently as last week, security experts said Chinese-language versions of Microsoft operating systems were immune to the latest worm outbreak.

Code Red II and Code III, discovered recently, are different worms and are not variants of Code Red, computer experts say.

Worms attack servers that run on Microsoft's Window NT and 2000 operating systems as well as its IIS server software then spread to other PCs.

The worms have been attacking computers in China since Monday, according to a Beijing manager from Network Associates, a California-based computer security company.

"It's very serious," he told CNN, adding that many large banks, financial institutions and manufacturers throughout the country have been attacked.

Network Associate's Beijing office has been flooded with telephone calls from clients all over the country.

The manager, who declined to give his name, said recent attacks such as Sircam and HappyTime have been by worms that crawl into servers via the Internet or deficiencies in the server's defence.

Computer worms differ from viruses -- viruses paralyse a computer by attaching to a computer file or document.

"We still don't know the origin of Code Red yet. But I think it's from China because the worm usually scans the server for Chinese-language programs before an attack," the manager said.

"Chinese hackers launched massive assaults on U.S. websites over the U.S. spy plane incident. This time Code Red attacked the White House website first. Chinese hackers are capable enough to create something like Code Red," he added.

Computers infected by Code Red were programmed to hit the White House Web site in July with a "denial of service" attack.

Last week state-run China Daily quoted a computer expert denying Code Red could be from China, after reports that web pages attacked by Code Red were defaced by a message: "Hacked by Chinese".

Code Red defaces non-Chinese-language web servers but lies dormant in Chinese-language systems, according to Daniel Cheng, China managing director of Symantec, a California-based Internet security firm.

But Code Red III, which no longer defaces the White House web site, is more powerful, opening doors to hackers to gain full control of a server from anywhere in the world, Cheng told CNN.