Sneaky new worm won`t get a grip on you

In the 48 hours following the wallop handed out by the "W32/MyDoom" or "Novarg" virus, Tiscali isolated over 30 000 infections - infections stopped dead in their tracks to the benefit of over 8 000 business e-mail addresses of corporate customers using Tiscali`s hosted AV (anti-virus) solution, MailMarshal.

The one nugget of useful information from the counsel of AV vendors and gurus is the one that says: don`t open an executable attachment from an indefinable source. Let`s face it, employees aren`t always that clued up on PC safety - sadly, it`s one drill never encouraged - leaving the worst bug in recent months to circulate at will.

The worm masked itself as an innocuous text document or file that appears unreadable, cunningly using this new tactic not only on unsuspecting computer users but also on unsuspecting servers and content filters that don`t, as a matter of course, block binary headers. A double click and you`re infected.

Customers using Tiscali hosted MailMarshal AV environment were already protected from the "W32/MyDoom" worm from 6am on the day of the hit.

Larry Paslovsky, General Manager, Enterprise Solutions at Tiscali, says: "The virus alert was sent out at 4.31am, and the MailMarshal servers (which check every 30 minutes for updates to the AV software) started blocking the virus at 5.30am.

"By 11am, over 1 500 infected mails destined to customers using the MailMarshal service were detected and deleted. As of writing, it was found that over 20 messages per minute were infected."

Customers using rules that block attachments with .exe, .scr, .bat,.cmd,.pif or .zip extension would have been already protected. "Since 99.9% of users have no business need to receive files with these extensions, companies blocking such files would not have been exposed to the virus even if they received it before updating their software," he adds.

In all instances of new worms and viruses, it`s about the speed at which vendors can deliver the required update or patch to the server, bearing in mind that each desktop is only protected to the extent of the latest patch update. But it`s also about bandwidth availability when the patch is delivered; who`s downloading what at that crucial moment; and, also about how quickly an organisation can execute the patch.

Many organisations have their own AV package in-house but neglect to regularly update virus tables or manage the AV environment effectively. Should a new virus hit, they`re simply not protected by virtue of having the required software. In a hosted situation, files are blocked at the host`s site long before it can enter a customer`s network. Updates are managed around the clock, providing ample lead-times to pick up on virus alerts and prevent exposure.

But these organisations can benefit from a hosted solution in addition to having their own AV software, as it will ensure added redundancy.

Significantly, by opting for a hosted AV solution, organisations also save bandwidth by circumventing the need to frequently download hefty updates and preventing infected files from replicating through the network. Paslovsky cites one instance in this recent attack where Tiscali blocked over 3 000 30kb infected files headed for a customer`s server.

MailMarshal is a hosted content management solution that enables a business to take control of company e-mail. It has the ability to scan text in documents, block executable files and protect against spam and viruses.

"By not using a hosted content management solution, organisations are at risk of pretty much anything," he advises.