Virus Probe Extends Into Canada

The Royal Canadian Mounted Police said Monday that it was investigating whether the Sobig.F computer virus that flooded computer networks with millions of unwanted e-mails last week originated from a computer in Canada.

Sobig.F is the fastest-spreading computer virus of its kind, computer-security experts have said. Companies including FedEx Corp., Starbucks Corp. and AOL Time Warner Inc. and the states of New Jersey, Pennsylvania and North Carolina have found the virus on their computer networks.

The RCMP declined to comment on the status of its investigation. The FBI already has begun its own inquiry, and Canadian authorities are working with that agency.

“It’s going to be hard to find the author,” said Mark Sunner, chief technology officer of New York-based MessageLabs Inc., a computer security company whose clients include the Federal Reserve.

“The nature of the virus itself lends itself to anonymity. You can remotely take control of a targeted machine,” he said.

A computer in Canada probably was accessed without its owner’s knowledge, said Jeff Minor, co-owner of Easynews.com Inc., an Internet service provider that has been subpoenaed in connection with the FBI’s investigation of the Sobig.F virus.

Phoenix-based Easynews provides users access to a Usenet computer bulletin board where the virus may have originated, experts have said.

The virus was disguised as a pornographic photograph. Anyone who clicked on the fake picture had their computer infected, according to Easynews.

Computer security experts were able to thwart an expected second wave of the Sobig.F attack Friday.

The virus automatically expires Sept. 10. Experts said other versions probably will follow.