Will Your PC Call 911?

If a local police officer shows up at your front door and demands to know why you dialed 911, chances are it's not a prank perpetrated by your kids.

More likely, your PC has been infected by BAT.Chode.Worm, a new wrinkle of computer worm that first appeared last week in the Houston area, and was reported over weekend by the FBI on the National Infrastructure Protection Center Web site.

And even though the FBI bulletin appeared on April 1, it's not a joke.

BAT.Chode.Worm has two nasty tricks up its sleeve. First, on every fifth infection, it uses your computer modem to dial 911 and then hangs up. And the standard operating procedure for all police departments is to investigate all 911 calls. (At the same time, the ruse will only work in North America, which is the only section of the world that uses 911 for emergency calls.)

In addition, on the nineteenth of the month, BAT.Chode.Worm erases all files in your PC's \Windows directories, rendering your PC inoperative. (The file-erasure payload doesn't affect Windows NT or Windows 2000 systems, unless you've renamed the default Windows installation directory to \Windows during installation.)

Looking to Share

Unlike a virus, BAT.Chode.Worm doesn't need you to download an infected file or open an infected e-mail attachment. It randomly searches IP addresses used by popular Internet service providers, and looks for "open" PCs that have file sharing enabled. When it finds one, it loads files that are run the next time you start your PC, infecting your PC with the 911 and directory erasure payloads.

Worse, your PC becomes part of the problem. Whenever you're connected to the Internet, BAT.Chode.Worm uses your connection to look for other open PCs and infects them too.

Experts who have analyzed the worm say users most likely to be infected are those who have accounts with AT&T Worldnet, BellSouth Net, Level3.Net, America Online, Mindspring, Earthlink, and in Canada, Air.Internet and PSInet.