Worm shuts down state's computers

MONTPELIER — An outbreak of what may be the Conficker computer worm required that the Agency of Human Services computer systems be shut down Friday.

There does not appear to have been information lost or inappropriately accessed, state officials said Friday. They hope to have the computer servers — which are necessary for the work of state employees from a variety of departments inside the agency — running again by Monday if not earlier, they said.

In the meantime, employees of the agency — which includes workers who take care of everything from public health to prisons to child abuse cases — will use paperwork to do and keep track of their work, said Robert Hofmann, head of AHS, the largest single part of state government.

"There are contingency plans to operate in a paper-based way while the servers are down," Hofmann said.

For instance, if an emergency like a case of elder abuse, for instance, comes up over the weekend "we have people who can deal with that without the necessity of a computer," Hofmann said.

Computer security experts have been nervous about the Conficker worm, one of the most widespread computer viruses in recent years. Because of some characteristics of the computer infection that affected the AHS computers it appears the problem may be part of Conficker, state officials said. The computer worm has infected hundreds of thousands if not millions of computers around the world, according to news reports.

Although state officials did not report this in Vermont, the computer program apparently began downloading so-called "scareware" or false anti-virus software that can trick users into paying for unnecessary or fake computer security programs, according to reports about infections of Conficker outside the state.

Exactly what the virus in the state computers is doing — and even if it is Conficker or not — is not yet clear, said Tom Murray, head of the state's Department of Information and Innovation.

"We are not quite sure what the long-term impacts are," he said. But, he added, "we are suspicious it is this Conficker worm"

In general it appears that Conficker, one of the more feared computer viruses of recent years, may be more of a prelude than a major problem in itself, according to news reports.

One thing it appears to do is shut down anti-virus software, reducing the defense capabilities of computers, Murray said.

Many of the computers inside AHS were not operational Friday not because they had been damaged by the virus, but because the system had to be isolated and shut down to prevent the spread of the rogue program, Murray said. Those systems are undamaged, even if they are temporarily unavailable, he said.

"We have put AHS out on an island," Murray said.

The problem does not seem to have spread to other computer systems in state government, and computer technicians in the agency will work into the weekend to fix the problem, Murray said.

"They are doing all of the right things," he said.

"We are fortunate, to some extent, this happened on a Friday afternoon," Hofmann said. That means only the work of those AHS employees who do 24-hour-a-day work and are on over the weekend will be affected, he said.

"All things considered I think we are pretty confident we are going to be back up and fully operational Monday morning if not sooner," Murray said.