10, 9, 8, 7, 6, 5, 4, 3, 2, 1

part of SPAN's network, but another internal estimate put the figure much higher: 250 to 300 machines. Each of those com- puters might have had 100 or more users. Figures were sketchy, but virtually everyone on the network - all 270 000 computer accounts - had been affected by the worm, either because their part of the network had been pulled off-line or because their machines had been harassed by the WANK worm as it tried again and again to login from an infected machine. By the end of the worm attack, the SPAN office had accumulated a list of affected sites which ran over two columns on several computer screens. Each of them had lodged some form of complaint about the worm.

Also by the end of the crisis, NASA and DOE computer network managers had their choice of vaccines, antidotes and blood tests for the WANK worm. McMahon had released ANTIWANK.COM, a program which killed the worm and vaccinated a system against further attacks, and WORM-INFO. TEXT, which provided a list of worm-infestation symptoms. Oberman's program, called [.SECURITY]CHECK_SYSTEM. COM, checked for all the security flaws used by the worm to sneak into a computer system. DEC also had a patch to cover the security hole in the DECNET account.

Whatever the real number of infected machines, the worm had certainly circumnavigated the globe. It had reach into European sites, such as CERN - formerly known as the European Centre for Nuclear Research - in Switzerland, through to Goddard's computers in Maryland, on to Fermilab in Chicago and propelled itself across the Pacific into the Riken Accelerator Facility in Japan.13

NASA officials told the media they believed the worm had been launched about 4.30 a.m. on Monday, 16 October.14 They also believed it had originated in Europe, possibly in France.