To keep the spread of the CodeRed worms from slowing down its cable Internet network, AT&T is blocking access to Web servers run by residential customers, a spokeswoman said Wednesday.

"We are trying to protect our greater user population as a whole," said AT&T spokeswoman Sarah Eder. The company provides cable Internet access to 1.35 million residential customers, she said.

By blocking incoming traffic to Web servers, AT&T is effectively shutting down the Web sites, which residential customers are not supposed to be operating anyway, Eder said.

"According to our official use policy, customers are not permitted to operate Web servers behind cable modems," she said.

Commercial customers of AT&T's cable Internet service are not affected, she added.

The CodeRed worms spread through a hole in Microsoft's Internet Information Server Web software running on Windows NT and 2000 computers and then scan the Internet looking for new computers to infect.

CodeRed II, which surfaced Saturday, leaves a "back door" on infected computers, making them vulnerable to future hacking.

CodeRed II also spreads more quickly, looking for computers in close proximity or the same network to infect rather than random computers on the Internet, like CodeRed I does.

This scanning of the local neighborhoods is slowing down cable modem networks, where subscribers share bandwidth.