Mail virus worms its way past Xtra

By MICHAEL FOREMAN

Telecom internet service provider Xtra and public relations company Botica Conroy were both the victims and the unwitting perpetrators of an e-mail virus yesterday.

And it was difficult to tell which company was more embarrassed.

Botica Conroy has the United States-based software company Symantec, maker of the Norton Anti-Virus package, as one of its key accounts.

Xtra is the country's largest internet provider, with more than 300,000 users.

Several Herald IT writers were among those who received copies of the W32. Prolin Worm virus - also known as the Prolin-Shockwave virus - from Xtra communications specialist Mary Parker (twice) and from Botica Conroy employee Bridget Paton-Tapsell.

The worm arrived between 3.18 pm and 4.06 pm in e-mail attachments to messages which read: "Check out this new flash movie that I downloaded just now ... It's Great. Bye."

The subject line of the e-mail reads, "A great Shockwave flash movie."

But anyone who opened the small executable file name creative.exe soon discovered that the "movie" was actually a worm that spreads via Microsoft Outlook by e-mailing itself to everyone in the Outlook address book.

The worm is fast spreading.

As well as moving jpeg and tiff image files to the root of the C drives, it adds insult to injury by telling the victim that it has "got yet another idiot" when opened.

In addition, ProLin-Shockwave seeks picture files of .jpg and .zip extensions on the local machine, moves them to a different location, and adds the suffix at the end "change at least now to Linux."

It has been found in more than 50 corporations, including Fortune 500 companies.

The virus also goes by the name of W32/ProLin@MM, TROJ_SHOCKWAVE. A, and CREATIVE TROJ_PROLIN. A.

Botica Conroy managing director Alan Botica was at a loss to explain how the worm had avoided the company's anti-virus software.

Mr Botica said the virus software was programmed to update itself every week with details of the latest viruses.

A definition for W32. Prolin. Worm, which was discovered last Thursday, should have been loaded.

Mr Botica said he would now switch to daily updating of virus software.

Ms Parker said she was the sole recipient of the virus in her company.

While all PCs at Xtra should update their virus definitions every day, Ms Parker said, the PC she used had failed to do so.

"I feel absolutely stupid.

"It's very embarrassing, but such is the nature of e-mail viruses."

Xtra had installed a filter by 4 pm to join five others protecting users against similar virus attacks.

The filter had detected 264 suspect e-mails by about 6 pm.

"Our customers should be completely safe," Ms Parker said.

Details of how the virus should be dealt with can be found on the internet at anti-virus sites such as nai.com and Symantec.