Virus infects communications with Mir

A month after the crew of the space station Mir was plagued by its computer shutting down three times in 15 days NASA last week found itself in a battle on the ground with a computer virus that spread from Houston to Moscow to infect workstations that are used for daily communications with the Mir crew.

A "macro" virus early this month infected all American and Russian personal computers and Apple Computer Inc. Macintosh machines called ground units which are used for various office automation functions including routine e-mail communications with the Mir crew said Jeffery Cardenas NASA's Mir operations and training manager. The virus was eliminated from all machines late last week.

Not Transmitted to Mir

Cardenas said the virus which was not caught by anti-virus software in the United States or Russia was not transmitted to the computers on board Mir. However some e-mail messages to American astronaut David Wolf were corrupted by the virus according to an e-mail message from Johnson Space Center's Mission Operations Directorate that was posted on the Internet.

The virus infection also forced officials in Houston and Moscow to avoid the use of e-mail attachments that were spreading the virus back and forth. Instead they used facsimile communications and e-mails without attachments.

"It hasn't been a block of communications " Cardenas said. "We're still able to send communications back and forth. It's just more tedious."

This viral infection comes on the heels of a tumultuous year for the space station Mir which the then-Soviet Union launched in 1986. Last month Congress opposed sending Wolf to the station to replace another American astronaut because of a string of mishaps including five computer glitches causing the spacecraft to spin out of control a fire and a collision with a cargo module that pierced the station's hull.

The Virus' Path

The JSC e-mail characterized the infection as a "very serious situation " noting that Russians who could not disinfect their systems said their machines were infected by American computers. Cardenas said the situation is still under review but NASA officials now think that an infected flight-data file containing proposed revisions to crew instructions was uploaded in Houston.

Infected data was then beamed via NASA's internal e-mail system to Moscow where the virus was spread to Russian and American workstations housed there. Higher-end systems such as Digital Equipment Corp.'s Alpha workstations were not affected.

The Russians often have outdated anti-virus software or none at all Cardenas said while NASA officials last week were upgrading to the latest version of their Norton anti-virus software developed by Symantec Corp. He said NASA may have been using outdated anti-virus software.

James Oberg a Houston-based space engineer and author who has testified before Congress on the Mir mission said this virus outbreak "appeared to be a particularly difficult virus" and that NASA officials were very concerned earlier in the month with disinfecting the ground-unit machines. There have been other viruses that have spread to the laptop computers on board Mir in the past year he said.

"They're time-consuming but they weren't particularly destructive " Oberg said. "There's a level of occurrences you've got to get used to. It's hard to judge when the actual level gets higher than should be tolerated. I think it has gotten higher [than should be tolerated]."

Henry Hertzfeld senior research scientist at George Washington University's Space Policy Institute said although he was not familiar with the virus infection this may be one of the first examples of a mishap of American origin associated with the Mir mission. Most of the Mir problems have been associated with the age of the Russian-built spacecraft and with human errors made by Russian participants he said.

"We all have problems with our computers " Hertzfeld said. "Your immediate reaction is [NASA] should have known better."

Macro viruses take their names from the macro language first created by Microsoft Corp. for inclusion in its Office 95 product the macro language allows users to eliminate repetitive tasks such as replacing a word that appears multiple times in a document said Jonathan Wheat senior anti-virus laboratory analyst at the Carlisle Pa.-based National Computer Security Association.

Once a document that contains a macro command is exposed to the virus the virus easily is spread to other parts of a user's system or transmitted to another user usually through e-mail attachments. With the release of Microsoft's Office 97 with the macro language these viruses have grown dramatically. Of the five to six new viruses that are created per day at least one is a macro virus Wheat said.

"Because [macro viruses] come out so often if you don't update your [anti-virus] product they will get by " Wheat said. "It's entirely possible that as big as NASA is maybe their anti-virus product wasn't updated."