Sybari Reports W32/MYLIFE.B Worm Virus is Beginning to Spread Rapidly; Antigen's Unique Worm Purge & File Filtering Features Ensure User Protection From Another E-mail Worm Virus

Business Wire, March 25, 2002

Business/Technology Editors

EAST NORTHPORT, N.Y.--(BUSINESS WIRE)--March 25, 2002

Sybari Software, Inc., the premier developer of Antigen, a comprehensive antivirus, content-management, and e-mail security solution for Microsoft Exchange and Lotus Domino environments, today reports that the e-mail virus known as MYLIFE.B is beginning to spread rapidly.

W32/MYLIFE.B arrives in e-mail with the subject line of "bill caricature" and the following body text:

"Hiiiii

how are youuuuuuuu?

look to bill caricature it's vvvery ffffunny :-) :-)

i promise you will love it? Ok

buy"

This is an e-mail worm, written in Visual Basic and compressed using UPX. It is 11524 bytes long. When run, it will display a small caricature, copy itself to the Windows System directory, and email itself out. In addition it will add a key to the Registry so that it is started during bootup: HKCU\Software\Microsoft\CurrentVersion\Run\win=%SYSDIR%\CARI.SCR

The worm also obviously contains code to delete files of type *.SYS, *.VXD, *.OCX and *.NLS and all files on the C:, D:, E:, and F: drives.

"By enabling either Antigen File Filtering(TM) or Antigen Worm Purge(TM) and updating to the latest antivirus signature files, our users can depend on Antigen to automatically purge all e-mail messages carrying this potentially devastating and high activity expeditious worm," said Joe Licari, director of product management for Sybari Software, Inc.

Sybari's Antigen for Microsoft Exchange has consistently demonstrated its ability to protect networks and defend against e-mail viruses such as MyLife.B. Antigen includes two robust content management features: Antigen Worm Purge(TM) and Antigen File Filtering(TM) (AFF). Antigen Worm Purge(TM) is a proactive safeguard tool against worms burrowing into e-mail networks. Antigen Worm Purge enables network administrators to prevent the overload of virus-generated messages that can be churned out when worm viruses are unleashed in an environment. Worm Purge deletes messages containing worm viruses in their entirety and prevents new worm threats from spreading before scanner engines can be updated. AFF enables administrators to proactively filter e-mail based on several filters including subject line, attachment filename, wildcards, and by file type.

POSTED ALERT

W32/MyLife.B@mm

W32/Cari.Ac, W32/Caric.A, WIN32/CARI, Win32/Cari.Worm

E-mail Subject:

bill caricature

E-mail Body:

Hiiiii

How are youuuuuuuu?

look to bill caricature it's vvvery verrrry ffffunny :-) :-)

i promise you will love it? ok

buy

========No Viruse Found========

MCAFEE.COM

Attachment Names:

cari.scr

Tom Buoniello, vice president of Product Management of Sybari Software, Inc. is available to discuss this latest worm virus, providing insight on:

-- What can be done to prevent the spread of this virus.

-- How companies can protect themselves from viruses prior to virus definitions
being available.

-- What companies should do if their networks are or become infected.

-- What other kinds of intrusions are likely to strike corporations.

Currently, Sybari has not reported outbreaks among Antigen users. To protect your environment from this new variant and for information on other variants, please add the Sybari website: http://www.sybari.com to your browser Favorites.

PRICING AND AVAILABILITY

Antigen 6.5 for Microsoft Exchange and Antigen 6 for Lotus Domino are currently shipping. The suggested retail price for Antigen, to protect 250 users within an organization, is $5,750.00 with a two-year renewable license (prices are quoted in US dollars, for local pricing please contact your local Sybari office). Discounted pricing is available based on volume. For product "trade-up" from vendors such as Network Associates (NYSE: NET), Symantec (NASDAQ:SYMC), and Trend Micro (NASDAQ:TMIC), Sybari offer's additional pricing and support options. For more information on Antigen and its award-winning features, contact Sybari at info@sybari.com or download an evaluation copy at www.sybari.com.

ABOUT SYBARI

Since 1995, Sybari has the led the market in providing innovative solutions to groupware-based virus and security threats. Today, over 6 million Microsoft Exchange/Outlook and Lotus Domino/Notes seats are virus-free as a direct result of Sybari's Antigen technology. Sybari's Antigen is unsurpassed in providing protection of corporate messaging environments. Antigen's unique architecture institutes a preemptive line of defense from viruses and malicious code. Antigen for Microsoft Exchange and Antigen for Lotus Domino are distributed in more than 50 countries through Sybari's worldwide locations and distribution network. Sybari is headquartered in East Northport, New York with an EMEA headquarters in Madrid, Spain and additional offices in Singapore, Australia, Brazil and Mexico. Sybari's clients include Amazon.com, Compaq, Con Edison, Dell, Deloitte & Touche, Eastman Chemical, Getronics, JD Power, Lufthansa, Mayo Foundation, Merrill Lynch, Nortel, Pirelli, Reckitt Benckiser, Sony, Texaco, Tosco, US Federal Government, and Visa. Sybari's many strategic partners include Lotus Development (NYSE:IBM), Microsoft (NASDAQ:MSFT), Computer Associates (NYSE:CA), Compaq (NYSE:CPQ), Sophos, Inc., Network Associates, Inc. (NYSE: NET), and Norman Data Defense Systems (Oslo Bors: NOR).