Code Red Costs Could Top $2 Billion

The worldwide labor costs associated with cleaning up the Code Red worm and its variants, including the still-rampaging Code Red II, now total more than $2 billion--and are rising, according to one research firm tracking the menace.

With an estimated 760,000 computers infected, Computer Economics estimates labor costs of repairing corrupted systems have hit $1.29 billion, with another $716 million consumed by lost productivity among affected users and help desk staffs.

Code Red and Code Red II, a more virulent sequel worm that began attacking systems worldwide in early August, exploit a known hole in Microsoft's Internet Information Server (IIS). A patch for the vulnerability has been available since mid-June.

But the worm is still spreading, says Michael Erbschloe, Computer Economics vice president of research. "My sense is we're sort of in the middle of it. It's kind of hard to call. We know people still are downloading patches from the Microsoft site."

Code Red's final cost is unlikely to eclipse the $8.7 billion price tag Computer Economics hung on damage attributable to the Love Bug, a virus that swept through the PC landscape last year, he says.

"If people don't get these servers patched, this is going to go on forever, and yes, it could be more [costly] than Love Bug. But I'm really anticipating patching before that point," he adds.

Because Microsoft's IIS software runs on Windows NT and 2000, operating systems most commonly used by businesses, home users are relatively unscathed by Code Red and Code Red II. Systems running Microsoft Windows 95, 98, or ME are unaffected by the virus.

But devices like routers that run IIS and are used in home networking systems, as well as high-speed Internet access networks used by consumers, are vulnerable.

Computer Economics made its estimates by studying news reports and expert analyses to reach a "consensus" figure for the number of PCs and servers affected worldwide, Erbschloe says. The firm then paired that number with its previously collected benchmarking data to determine an average per-server clean-up cost (ranging from $300 to more than $1000, according to Erbschloe). Combining those leads to its $2.05 billion "total economic impact worldwide" statistic.

However, some cable modem service operators say they've seen little Code Red impact on their networks.

"We're continually monitoring the situation, and the impact has been minimal," says Estela Mendoza, a spokesperson for @Home, which serves 3.6 million residential customers with its Excite@Home cable.

"I think things are going pretty well. We continue to have had a minimal impact from it," says Mike Luftman, a spokesperson for AOL Time Warner, which operates the Road Runner cable modem service. Fewer than 1000 of the company's 1.2 million residential customers were affected by the worm, he says.

Road Runner and Excite@Home have experienced some localized slowdowns, but no uncontrollable breakouts, the representatives say. Both say the cost of fighting Code Red will be minor for their companies.

Two major DSL providers also expressed no worries about the worms' impact. Code Red has had minimal effect on network operations because the companies had sufficient advance planning and warning, representatives of both providers say.

George Chidi in Boston contributed to this report.