CHICAGO - A new computer virus infected quarterly software disks Ibbotson Associates Inc. sent to its clients.
Michael C. Henkel, managing director, called the virus benign, meaning it hasn't harmed any data or programs.
Only about 5% to 10% of the 500 to 1,000 consultants, money managers and other customers who buy the Ibbotson software contracted the virus from the Ibbotson disks, he estimated.
But the virus showed how even a so-called benign or harmless manifestation can be disruptive and costly to clean up.
"It's been a lot of work .*.*. a real pain," said Mr. Henkel. "Welcome to the information highway.
"We're victims," he added. "It costs a lot of money to fix it and a lot of time."
Ibbotson advised all customers to destroy the disks, which contain quarterly data updates used for Ibbotson analytical programs. "We didn't want them infecting themselves or someone else," Mr. Henkel said.
Ibbotson plans to send new disks at its own expense as soon as it can make them and ensure they are virus free. It discovered the virus Oct. 25.
Ibbotson contracted with Central Point Software Inc., Beaverton, Ore., a unit of Symantec Corp., Cupertino, Calif., to write a special program to kill the virus. Ibbotson expected to have the program ready last week to send to clients.
Mr. Henkel declined to estimate the cost, but said such programs can retail for $150 or more each. He said Ibbotson negotiated with Central Point over the licensing cost.
"The cost to Ibbotson is "not an insignificant amount of money," Mr. Henkel said. "I'd rather be safe than sorry."
He added: "The virus rendered the Ibbotson data unusable for two weeks" at least.
The incident also showed how difficult a virus can be to detect.
The virus eluded Ibbotson's own sophisticated virus detection system, which it uses to check disks before shipping them to clients.
Ibbotson learned of the virus from a customer using the newly shipped disks. The virus set off an alarm in the customer's virus-detection system. The virus was the first to infect any Ibbotson software, Mr. Henkel said.
Ibbotson reacted swiftly and advised all customers of the virus, catching 60% to 70% of them before they had installed the new disks.
Only 5% to 10% of the clients contracted the virus because it manifested itself only when users inadvertently rebooted their systems with the disk in the disk drive.
"You would not be able to detect the virus unless you had a very recent version" of a virus-detection program, no more than two weeks old, Mr. Henkel said.
"The virus doesn't do anything," he said. "It just is there." He said the virus sets off an alarm in a virus-detection program, but otherwise it is dormant.
"Only the latest version of virus detection picked it up," he said. "Unless you have the latest version, you wouldn't even know the virus was there."
People in the industry call the virus GNED or NYB, he added.
Even virus-detection firms had difficulty pinpointing it. McAfee Associates Inc., Santa Clara, Calif., "could pick it up only recently, but couldn't clean it," Mr. Henkel said.
Norton Group, Cupertino, another Symantec unit, and a federal government-sponsored virus-detection bulletin board were equally of little help, Mr. Henkel added.
Only Central Point could clean up the virus, he said.
Mr. Henkel acknowledged the virus could appear benign in the short term, but have a destructive remote time release.
"It's possible it could have a trigger to set something off," Mr. Henkel said.
"The general consensus in the industry is that if it was going to do something bad, it would have done so by now."
One user, Hammond Associates Inc., a St. Louis-based consultant, said he hadn't yet installed the software when Ibbotson warned it of the danger, said Dennis M. Hammond, president.
Another user, Kidder Peabody PRIME Asset Consulting Group, New York, also hadn't yet installed it when it received the warning.
Speaking of viruses in general, Charles J. McPike, managing partner at Richards & Tierney Inc., Chicago, who oversees the computer system said: "You don't really know if it's benign.
"The scariest thing is it shows how you really have to keep abreast of the most recent viruses. If you're paranoid, you have to call Compuserve Inc. (the online computer communications system) every day" to see if there are reports of new viruses cropping up.
In terms of new precautions at Ibbotson, Mr. Henkel said there is nothing much more Ibbotson can do.
"About the only thing we can do is that during the production process (when it is making its quarterly data disks for its customers), we can check (computer) bulletin boards to see if there is any new virus-detection software," Mr. Henkel said.
"We've done that regularly. But now we will just have to call (the bulletin boards) every day during production," Mr. Henkel added.
