Outbreak Name: Storm Trojan*

Outbreak Date: 01-19-07

Largest Outbreak in Twelve Months Hits Internet Outbreak Filters Protects Users 3 hours and 33 minutes Before First AV Signature

Background

IronPort's Virus Outbreak Filters protects customers within the critical period between the first exploit of a virus outbreak and the release of an AV signature. During the recent "Storm Trojan" outbreak, Outbreak Filters protected customers 3 hours and 33 minutes before traditional AV vendors** provided protection.

Potential Damage from Outbreak

The "Storm Trojan" is the largest outbreak in the last twelve months, accounting for 1 in 200 email messages worldwide at its peak.

The outbreak contained fake news subject lines such as "Sadam Hussein Alive" (sic) and "Chinese missile shot down USA aircraft" and asked users to open a virus infected file for more details on the news. Once installed, the virus opens a backdoor that remote hackers can use to take over the computer. Hackers can use these infected PCs to send spam, host spyware and install key loggers and screen scrapers onto the infected PC.

Virus Outbreak Filters stopped over 300,000 viral messages prior to AV Signature availability, saving customers over $15.4M in less than 4 hours.

Timeline

* As named by Sophos.
** Calculated as publicly published signatures from the following vendors: Sophos, Trend Micro, Computer Associates, F-Secure, Symantec and McAfee. If signature time is not available, first publicly published alert time is used. Generic signatures not included.
*** Assumes 10% of messages opened and $500 per desktop clean-up cost.