I showed you way back in early February how the antivirus firms remained calm & cool during a round of media hoopla over the Conficker / Downadup worm. Nearly two months has passed since then. It’s now the end of March … and the antivirus firms remain calm & cool.

In other words: nothing has changed.

In all that time, IBM’s Internet Security Systems never raised its Internet threat level above “normal.” In all that time, Kaspersky Labs never raised its assessment of the worm above “moderate risk.” In all that time, McAfee never raised its global threat condition due to Conficker / Downadup. In all that time, the SANS Internet Storm Center never raised its Internet threat level above “green.” In all that time, Symantec never raised its ThreatCon due to Conficker / Downadup. In all that time, Trend Micro never posted a medium- or high-risk alert over the worm.

And what about antivirus vendor Sophos? Well, in the days leading up to this latest hoopla … they fretted more about Russian brides than the Conficker / Downadup worm.

I still can’t recall a time in the last twenty years when when so many antivirus firms remained so calm during a media circus. A second media circus, no less. Color me stupified.

I’ve slapped the U.S. Air Force around over the years for their obsessive-compulsive behavior to attack their own computing capability “as a precaution” whenever they fear a virus might attack their computing capability.

Well, now it appears France’s navy has joined the OCD club. A headline in Britain’s Daily Telegraph proclaims “French fighter planes grounded by computer virus.” A subheading notes the fabulous French flying machines “were unable to take off after military computers were infected by a computer virus, an intelligence magazine claims.”

French navy spokesman Jérome Erulin said “it was a security problem we had already simulated.” It pleases me to know the French military keeps up with their surrender skills…

Unable to take off? Thank goodness. I’d hate to hear about hundreds of Frenchmen bobbing in the ocean after bailing out to protect themselves from the Downadup worm. “Mayday! Mayday! Frenchy-Paris-Two-Five-Niner, I’ve got a Krusty the Clown screen icon on my heads-up display! Ejecting immediately! Frenchy-Paris-Two-Five-Niner eject eject eject!”

Reading the first paragraph of the story, we begin to realize the navy’s flight tasking “databases were infected by a Microsoft virus they had already been warned about several months beforehand.” In other words, we can assume the aircraft themselves remained worm-free — only the flight planners’ servers & desktops got whacked.

I spent 26 years in an Air Force uniform and I can assure you of two things. First: all militaries give high priority to bombing an enemy’s flight planning headquarters. Second: all militaries train their airmen to operate after the flight planning headquarters gets attacked. Military training usually goes like this:

“Pilots, our exercise scenario today begins with the enemy taking out our flight planners. {Pilots applaud & give high-fives.} Okay, that’s enough. They’re a critical part of our team, you know. {Pilots cough in a mocking fashion.} The wing commander will need to act decisively to maintain air superiority during the exercise…”

The news story mentions the French navy’s OCD in its second paragraph. “At one point French naval staff were also instructed not to even open their computers.” Can you imagine the email they must have received?

Fm: French High Military Command
To: All naval personnel
Subj: Turn off all computers
Charge d’Affairs orders all personnel to immediately shut off all naval computers. We will send an email telling you when you may turn your computers back on…

Later in the story, “Jérome Erulin, [a] French navy spokesman, [said] ‘It was a security problem we had already simulated.’ ” Aha, great news. It pleases me to know the French military keeps up with their surrender skills.

Anyway, it’s a cute story except for the fact that France lost all of its naval aviation. So, uh … who were the French locked in mortal combat with?

The media hysteria over the Downadup worm may or may not have peaked. I say this because the press now reports “20 million” infections as if it’s no big deal.

Where did reporters get this new “20 million” figure?

Take Current World News, for example. They ran a very short piece titled “20 Million PCs Infected With Conficker Worm Virus.” It technically has six paragraphs, except the final three paragraphs contain one sentence each.

“To date, efforts to stop the virus from spreading have been futile, leaving computer experts stumped,” reads the entire fourth paragraph. I fully expected this story to include a quote from a stumped expert … but, no.

Or take eCandadaNow. They ran an ultra-short piece titled “Computer Virus Now Slams Nearly 20 Million PCs.” Each of the {ahem} “seven paragraphs” is a single sentence. A cute “monster” graphic takes up almost exactly half of the article’s total space. No explanation where the “20 million” guesstimate comes from.

Have reporters finally started to grow bored with the Downadup worm? “Contact me when it actually does something…”

The media continues to deliver more ink, and more hysteria, over the Downadup worm. Infection estimates now range anywhere from 10-15 million, and that’s just on the low end. Basically it all boils down to what flavor of crack the reporters’ sources prefer…

“[Downadup] may have managed to compromise as many as nearly one in three” PCs on the planet…

Take UPI’s sources, for example: they obviously prefer strawberry-flavored crack. That’s why we see UPI headlines like “Virus strikes 15 million PCs.” I mean, come on — an international news outlet cited a hometown newspaper story as its primary source for high-tech news. Somebody’s gotta be puttin’ a lighter to the rock when that happens!

Or take this Networkworld source who uttered his prediction through raspberry-scented smoke rings. “‘[This worm] has the potential to infect about 30% of Windows systems online, a potential 300 to 350 million PCs,’ says Don Jackson, director of threat intelligence in the counter threat unit at SecureWorks.”

And I’m guessing Computerworld’s sources enjoy the blueberry-flavored crack. “[Downadup] has infected at least one out of every 16 PCs worldwide, a security company said today, and it may have managed to compromise as many as nearly one in three,” reads the first sentence. Who did Computerworld attribute to these figures? Why, none other than Ryan Sherstobitoff (Panda Security) — the same guy I bashed yesterday for unwittingly comparing Downadup to the villain in the movie Eagle Eye.

“I’m pretty confident in this number,” Sherstobitoff told reporter Gregg Keizer, who wrote that “in fact, Panda’s estimate is probably very conservative, Sherstobitoff said.”

SecureWorks flunky Don Jackson proclaimed Downadup “has the potential to infect about 30% of Windows systems online, a potential 300 to 350 million PCs…”

(Memo to Gregg Keizer: Notice the highlights in the previous paragraph? They actually teach you in Journalism 101 not to use “fact, estimate, probably” in the same sentence. You should take a course sometime…)

We know for a fact Keizer’s source inhales the smurf smoke — because nobody in their right mind would dare to claim this worm already “may have managed to compromise as many as nearly one in three” PCs on the planet. Even Jackson managed to hedge his bets by saying this worm only “has the potential to infect” one-third of all the PCs on mothership earth.

As of 6pm tonight, the websites for McAfee, Symantec, Trend Micro, Kaspersky Labs, Sophos, SANS, ISS, et al. still display a blasé attitude about the Downadup worm. Who in their right mind can predict “potential[ly] 300 to 350 million” infections with no support from the big boys in the industry?

To paraphrase comedian Lewis Black: “What this is, purely and simply, is a clinical psychotic reaction. They are stone cold nuts. I can’t be kind about this — because these people are watching this episode of “Fringe” as if it’s a documentary…”

---

Let’s face it: you gotta be smoking Frank Herbert’s “Dune spice” to come up with the bizarre graphics attached to all these stories. Check out the Fremen-inspired graphic in a dbTechno story, for example. Listen closely and you’ll hear them calling for Shai-Hulud after each toke.

Did you like the movie “Tremors”? Check out the UZI4U-inspired graphic at TheTechHerald.com. Looking for something a little more family friendly? You’ll love the Y7-inspired graphic at PCWorld France.

Do you like the Food Channel? Check out the Zimmern-inspired graphic at the Wall Street Journal…

{sigh} Let me put it in simple terms, folks. The media loves computer security hysteria: it breaks up the monotony of their day. And the wild “expert” sources certainly love the media attention.

Seriously: take a moment to peruse Wikipedia’s article on yellow journalism. Do the “five characteristics” seem vaguely familiar?

One expert’s quote in a Wall Street Journal story caught my eye. Reporter Ben Worthen filed a story with the headline “The Conficker Virus: Don’t Panic.” Check out this gem:

Ryan Sherstobitoff, a security evangelist with Panda Security, says it may just be a big distraction to divert attention from “a monster data breach that no one knows about yet.”

You know, I think Sherstobitoff watched the movie Eagle Eye a few too many times. I distinctly recall Agent Perez saying almost exactly the same thing in last year’s cyber-terror cinema. After staring in utter disbelief at all of the implausible things that had happened, Perez barks out the paranoid question: “what if it’s a decoy to distract us from something fifty times bigger?!?”

Next thing you know, Sherstobitoff will spout lines from Cloverfield. “Good grief, that towering monster may just be a big distraction to divert attention from” the invading hordes of aliens in Independence Day! (Which, you might recall, involved a computer virus written on a Mac…)

A new headline at PC Magazine calls the Downadup worm an “epidemic.” Other news outlets have latched onto the story with similar weasel words and trigger phrases. If you take the “growing exponentially” claims at face value, then throw away your PC right now because we’re doomed. Experts predict this worm will infect at least 8.7 billion PCs by Sunday.

The antivirus firm behind the hype is now offering prizes to people who test their new product. “Wow, that’s really cool!” F-Secure doesn’t want all that global media exposure to go to waste, you know…

(“One computer for every dollar the ILoveYou virus cost, eh Rob?” Exactly! You’re catching on.)

In other words, I may have been mistaken in yesterday’s “died on the vine” comment. The media has waited a very long time to orgasm over a virus story and I once again wonder if they can hold back their ecstasy…

…Except there’s a tiny little problem. The antivirus vendors just don’t seem interested in it!

Take Symantec, for example — they actually lowered their ThreatCon status today from “2″ (elevated) to “1″ (normal). Kaspersky Labs still describes Downadup as a “moderate risk.” Neither McAfee nor Trend Micro has updated their alert pages. SANS continues to show a “green” Internet threat level. About.com virus expert Mary Landesman tackled a different subject in today’s column.

And F-Secure…

Hmmm, F-Secure. You know, I don’t think F-Secure will like the rest of my column.

F-Secure — the antivirus firm behind the “nine million” estimate — announced they released a “Removal Tool” for the Downadup worm. Oh, and be sure to check out their new beta security product! “Feedback enrolls users into prize giveaways,” F-Secure bragged. “We recently received another batch of our very popular laptop stickers, so as a bonus, we’ll pass along a stack to Tomi [from the Customer Involvement Team].”

Waitaminit. Laptop stickers?!? Pardon me while I say “wow, that’s really cool!”

Folks, the press wants us to believe there’s a global “epidemic.” So what does F-Secure do with all the media attention they whipped up? Why, they turn it into an opportunity to recruit beta testers for a new product!

{sniff} Do I smell something familiar? Or did I just forget to the flush the toilet?