Sybari Reports W32/GONER.A-MM Virus is Spreading Rapidly; Antigen Worm Purge & File Filtering Feature Ensures User Protection From Another E-mail Worm Virus

Business Wire, Dec 4, 2001

Business/Hi-Tech Writers

EAST NORTHPORT, N.Y.--(BUSINESS WIRE)--Dec. 4, 2001

Sybari Software, Inc., the premier developer of Antigen, a comprehensive antivirus, content-management, and e-mail security solution for Microsoft Exchange and Lotus Domino groupware servers, today reports on the e-mail virus known as W32/GONER.A-MM, which is rapidly spreading throughout the Internet at a reported rate of approximately 1 copy per 30 emails.

Dubbed Pentagone, Goner or Gone, the Visual Basic Script program spreads via e-mail and the messaging system ICQ. On infected computers, it stops most antivirus and security programs. However, this latest e-mail virus threat is no match for Sybari's Antigen. Antigen's Worm Purge and File Filtering features will score high-marks with Antigen users.

"Our users stand protected against this virus with Antigen Worm Purge(TM)," said Joe Licari, director of product management for Sybari Software, Inc. "By enabling Worm Purge and updating to the latest antivirus signature files, administrators can depend on Antigen to automatically purge all e-mail messages carrying this high activity worm," continued Licari.

Sybari's Antigen for Microsoft Exchange, has consistently demonstrated its ability to protect networks and defend e-mail viruses, such as Goner.A-mm. Antigen includes two robust content management features: Antigen File Filtering(TM) (AFF) and Antigen Worm Purge(TM). AFF enables administrators to proactively filter e-mail based on several filters including subject line, attachment filename, wildcards, and by file type. Antigen Worm Purge(TM) is a proactive safeguard tool against worms burrowing into e-mail networks, enabling network administrators to prevent the overload of virus-generated messages churned out when worm viruses are unleashed in an environment. Worm Purge deletes messages containing worm viruses in their entirety and prevents new worm threats from spreading before scanner engines can be updated.

POSTED ALERT

Details

The worm only affects computers running Microsoft Windows and spreads through Outlook e-mail clients. Macs and computers running Linux or other Unix-like operating systems are unaffected.

The virus creates emails with the following characteristics.

Subject: Hi

Text:

How are you ?

When I saw this screen saver, I immediately thought about you I am

in a harry, I promise you will love it!

Attachment: gone.scr

Size: 38912

When the file is opened, Pentagone will infect the victim's PC, stopping a variety of antivirus and security applications and deleting all the files in the folders containing those applications. After eliminating the security on the computer, the worm opens up a dialog box containing its name, Pentagone, the handles of its creators. The dialog box also includes acknowledgements to other people on the Net, in a style similar to that of online vandals who deface Web sites.

The worm then installs a backdoor program linked to mIRC, a popular Internet Relay Chat program. The backdoor can be used to execute denial-of-service attacks against IRC servers.

In addition, the virus attempts to spread using e-mail and ICQ.

To spread by e-mail, Pentagone uses script commands to send a copy of itself to every entry in someone's Outlook address book. In ICQ, the worm uses specific commands to send a copy of itself to other people using the messaging application.

Joe Licari, Director of Product Management of Sybari Software, Inc. is available today to discuss this latest worm virus, providing insight on:

- What could have been done to prevent the spread of this virus.

- How companies can protect themselves from viruses prior to virus definitions
being available.

- What companies should do if their networks are or become infected. o What
other kinds of intrusions are likely to strike corporations.

Currently, Sybari has not reported any outbreaks. To protect your environment from this new variant, and for information on other variants, please add the Sybari website: http://www.sybari.com to your browser Favorites.

PRICING AND AVAILABILITY

Antigen 6.2 for Microsoft Exchange is currently shipping. Antigen is available as a two-year renewable license, based on the number of users protected within an organization. Antigen's price ranges from $27.50 - $7.50 per user (prices are quoted in US dollars, for local pricing please contact your local Sybari office). Discounted pricing is available based on volume. For product "trade-up" from vendors such as such as Network Associates (NASDAQ:NETA), Symantec (NASDAQ:SYMC), and Trend Micro (NASDAQ:TMIC), Sybari offer's additional pricing and support options. For more information on Antigen and its award-winning features, contact us at info@sybari.com or download your evaluation copy today at www.sybari.com.

ABOUT SYBARI

Since 1995, Sybari has the led the market in providing innovative solutions to groupware-based virus and security threats. Today, over 5 million Microsoft Exchange/Outlook and Lotus Domino/Notes seats are virus-free as a direct result of Sybari's Antigen technology. Sybari's Antigen is unsurpassed in providing protection of corporate messaging environments. Antigen's unique architecture institutes a preemptive line of defense from viruses and malicious code. Antigen for Microsoft Exchange and Antigen for Lotus Domino are distributed in more than 50 countries through Sybari's worldwide locations and distribution network. Sybari is headquartered in East. Northport, New York with its International headquarters in Madrid, Spain. Sybari's clients include IBM, Amazon.com, Cable & Wireless, Compaq, Con Edison, Dell, Deloitte & Touche, Eastman Chemical, Getronics, JD Power, Lufthansa, Mayo Foundation, Merrill Lynch, Nortel, Pirelli, Reckitt Benckiser, Sony, Target, Texaco, Tosco, Union Pacific, US Federal Government, and Visa. Sybari's many strategic partners include Lotus Development (NYSE:IBM), Microsoft (NASDAQ:MSFT), Computer Associates (NYSE:CA), Compaq (NYSE:CPQ), and Sun Microsystems (NASDAQ:SUNW).