“Why me?” Thats what plenty of PC users were asking themselves last December, shortly after they opened an e-mail message from an acquaintance with this subject line and found their systems infected with Win32/Sober.C, yet another in a seemingly endless stream of worms zooming around the Internet.
Many of those infected were probably good Internet citizens, running antivirus software with up-to-date signatures that should have stopped every known virus in the wild. Unfortunately, too often today, worms (viruslike programs that can spread themselves to other machines without user intervention) get into the wild before antivirus companies can create and distribute appropriate signatures. Technically, most recent worms are fairly unsophisticated, but they all use clever social-engineering tricks (the e-mail address of someone known to the recipient, with enticing subject lines, message text, and attachment names) to make people open the files, thus kicking off incredibly rapid outbreaks.
According to AV-Test.org, a project of the Otto von Guericke University Magdeburg in Germany and AV-Test GmbH, the Romania-based Softwin (creator of BitDefender) was the first antivirus company to have a definition for Sober.C—10 hours after the virus was first detected. Symantec didnt have a signature available until more than a day after the first sighting, and McAfees came a day after that. In an article on outbreak response time in the February 2004 Virus Bulletin (www.virusbtn.com), AV-Tests Andreas Marx was quick to point out that the company that was first for this particular virus may not be first the next time. But it doesnt really matter. Even a 10-hour response time is too slow.