PRWeb, November 24, 2002

New virus stopped within 10 minutes
No chance for the i-worm Roron to infect SaferSurf users

After the Bugbear went on its global rampage, Kaspersky Labs reported a new dangerous worm developed in Bulgaria. The i-worm Roron (also known as Oror.B) triggered a red alert and is considered to be very dangerous. As usual it was left to the user to protect himself against the new virus. This way the virus had enough time to spread itself from Bulgaria all over the world and to infect thousands of computers. A few details about Roron:

Its ability to spread itself through several channels makes this worm highly dangerous for all unprotected computer users. Once again an e-mail file attachment is used as means of distribution. While installing, the worm copies itself to the Windows directory and registers this file in the system registry auto-run keys. In addition Roron copies itself to Windows system and the Program Files directory. This way the worm makes sure that it is activated whenever the operating system is restarted.

Roron has got a whole repository of very dangerous destruction and espionage functions. The worm's INI file is a backdoor script program that enables hackers to have control over the infected machine and for example to send, receive and execute files. In addition Roron can remove all files from any drive of an infected computer. For more alarming news regarding the Roron worm, please refer to the virus encyclopedia www.viruslist.com on the web.

"After Bugbear, who deactivated a number of security programs, we are now going to experience a new flood of viruses that are using the same methods. Users who believe that their installed virus scanner or a personal firewall offers enough protection, are mistaken. The protection has to set in before the PC", said Rene Holzer, CEO of Nutzwerk and inventor of the real-time data filter SaferSurf, even back in October.

SaferSurf.com provides a different kind of virus protection. Every file that comes from the internet and every e-mail attachment is scanned on its way from the internet. Infected files are deleted before they can reach the user computer. The SaferSurf virus scanners are updated every few minutes.

When the new Roron virus turned up, all SaferSurf users were protected automatically in just 10 minutes. The spreading of the virus was stopped abruptly without a user having to update their anti-virus program.

"We wonder what the virus programmers are thinking of next. As SaferSurf resides outside the user computer and works centrally, all SaferSurf users are protected automatically. If a new virus or malware appears, we usually have a countermeasure within a few minutes", continues Holzer.