Watching the web for viruses

Businesses are sounding the alarm when viruses strike

By BBC News Online internet reporter Mark Ward

British businesses are setting up an early warning system to let them know when destructive computer viruses are on the rampage.

The system will act like a neighbourhood watch scheme for cyberspace and alert e-mail administrators when one of the group is hit by a new virus.

Companies involved in the scheme are hoping that the informal network will mean they get information even before the anti-virus companies issue an alert.

Already the network has helped members of the network avoid being hit by a variant of the Love Bug virus.

Community action

The Enterprise Virus Alert Community (EVAC) has been founded by Alex Morgan, technical support consultant at electronic marketplace maker Intelisys.

He said a need for such a community became obvious when e-mail administrators talked about the damage the ILoveYou virus did in May this year. That virus spread fast and did its damage before most people knew it was a danger.

"What struck me, and a number of other e-mail administrators, is that these things happen far faster than any updates can help us," said Mr Morgan.

EVAC was established by about ten UK e-mail administrators who saw a need for a network to operate outside the companies they work for he said.

EVAC has been running for a couple of months and has about 17 members including technology companies, household names and high street banks.

Damage limitation

When any member of EVAC is hit by a novel virus, either a completely new one or a vicious variant of an old one, they pass on a warning which is distributed to all members of the network.

Warnings about serious problems are sent using short text messages sent to the mobile phones of administrators.

As experienced administrators, EVAC members say they are careful not to pass on information about hoaxes which can take as much time to clear up as real viruses.

The early warnings let the administrators react instantly to adjust filters to remove the dangerous payloads on a virus or quarantine suspect messages until a cure is available from the anti-virus companies.

Graham Cluley, senior technical consultant at anti-virus company Sophos, said often companies are hit by viruses before it knows about them and has a cure available.

Other warning networks, such as the Computer Emergency Response Team, do exist but they typically only find out about security problems after a lot of companies have been hit.

The EVAC network has already helped its members stop the Life Stages, aka VBS/Stages-A, virus do anything other than minor damage.