Due to its morphing nature, only content checking gateways can stop it!

London, UK, 25 July 2001 - The current assault by the new SirCam email virus - a fast-spreading destructive worm - is a fresh reminder that organizations can only be safe against email attacks such as this if they have installed an email content checking gateway at email server level. Because the SirCam worm can disguise itself by morphing and adopting different Subject lines each time it spreads, anti-virus protection alone is not enough, warned GFI, developer of Mail essentials for Exchange/SMTP, the leading email content checking and anti-virus solution.

This virulent new email worm is spreading fast, disseminating by emailing copies of itself to all contacts in the email address books of infected users. Besides, it sends a random file from the infected user's PC as an attachment, meaning that this alarming virus could possibly send out confidential corporate information in the process. The subject line of the email takes the name of the file sent out when the SirCam worm replicates itself, making it much harder for recipients to identify as a virus.

The virus is activated when the recipient double-clicks on its attachment, which masks an executable file such as a .bat, .com, .lnk and/or .pif file. It then launches a damaging attack on the recipient's PC, able to destroy files and directories and occupy hard disk space, as well as mass mailing itself.

"This latest development in the sphere of harmful email worms highlights the need for full corporate protection against email attacks and viruses," stressed Nick Galea, GFI CEO. "The fact that the SirCam worm is more sophisticated and less definable to the user because it morphs itself means that organizations must apply safeguards against viruses at email server level. With our email security product, Mail essentials, networks are protected against the SirCam worm and any of its variants because Mail essentials blocks infected and dubious files, such as .bat, .com, .lnk and .pif files, at server level through its content checking module."

For more information about the virus, visit http://www.norman.com/virus_info/w32_sircam.shtml. More information about Mail essentials may be found at http://www.gfi.com/mesindex.htm.