Close-up: Worms

Microsoft Corp., the Federal Computer Incident Response Center and many other organizations first put out alerts back in mid-July for the vulnerability used by the Blaster worm and the Welchia variant. Microsoft made the patch available at that time.

The original worm was easier to block because it only used one of the exploits for the vulnerability and did not spread rapidly. The variant, however, rooted quickly through networks, looking for Blaster by several means in order to remove it and automatically apply the Microsoft patch. "That generates a huge amount of traffic inside the organization...and it can take weeks to a month to roll out a patch," said Vincent Weafer, senior director of Symantec Corp.'s Security Response Center. There are still several other ways to exploit the vulnerability, so systems administrators and home users should continue working to apply the patch on any untouched systems, warned Scott Paisley, technology director for Internet Security Systems.