Outbreak Name: Storm Trojan*

Outbreak Date: 04-11-07

Massive Outbreak Hits Internet for the Second Time in 4 Months

Outbreak Filters Protects Users 3 hours and 55 minutes Before First AV Signature

Background

IronPort's Virus Outbreak Filters protects customers within the critical period between the first exploit of a virus outbreak and the release of an AV signature. During the recent "Storm Trojan" outbreak, Outbreak Filters protected customers 3 hours and 55 minutes before traditional AV vendors** provided protection.

Potential Damage from Outbreak

The "Storm Trojan" is the one of the largest outbreaks in the last twelve months. This outbreak is a variant of the original Storm Trojan that first propagated in Jan '07 in similar volumes.

The outbreak contained romantic subject lines such as "Sending You My Love" and "You're the One" designed to entice recipients to open attached virus infected files. Once installed, the virus turns off desktop anti-virus programs. It then opens a backdoor that remote hackers can use to take over the computer. Hackers can use these infected PCs to send spam, host spyware and install key loggers and screen scrapers onto the infected PC.

Virus Outbreak Filters stopped over 350,000 viral messages prior to AV signature availability, saving customers over $17.8M, or over $13,000 per customer - in one outbreak.

Timeline

* Generic industry name. Other names include: Dref-AG, Zhelatin.cs and Nuwar.
** Vendor signature times per AV-Test. Signature times from the following vendors: Sophos, Trend Micro, Symantec and McAfee. Generic signatures not included.
*** Assumes 10% of messages opened and $500 per desktop clean-up cost.