Press release May 05, 2000

Giving Love Letters the Brush-off
Filtering instead of scanning – New technology for the protection against viruses in eMails

The damage caused by the Loveletter computer virus on Thursday shows again that anti-virus software is not enough to protect companies and institutions against unwanted and dangerous electronic mail. The Nutzwerk company owns a technology for an eMail firewall that is based on content-related filtering and lets viruses like Loveletter stagnate on the internet.

The eMail firewall developed by the company from Halle is a server which monitors the entire eMail traffic. It can be installed at the provider or within the company. It combines several mechanisms to prevent viruses like Loveletter from reaching the user.

System administrators can centrally block the receipt of certain file types with a single click. The message itself reaches the recipient, while the attached file that represents a potential danger is put in quarantine.

With this technology the avalanche-like spreading of the virus would have been stopped without having a negative effect on users. They would have been able to send and receive eMails as ususal. But like this many companies had to disconnect their mail servers entirely from the network. Many of them are still offline.

In addition the eMail firewall by Nutzwerk works with so-called black and white lists. This makes it possible to tell apart trustworthy from not trustworthy senders. The third big obstacle for the Loveletter would have been the content-related filtering. It would have blocked the dangerous file attachment even if it had been renamed.

"The companies put too much trust in their anti-virus software. They hadn't expected the virus to spread so quickly", says Nutzwerk CEO René Holzer. "With our approach of the eMail firewall we mainly count on the filter tool. Anti-virus software is being used. But we don't put all our eggs in one basket."

The development of the eMail firewall by Nutzwerk was triggered by the sudden appearance of computer virus Melissa the year before. After that the developers began to look for possibilities to stop viruses without a virus scanner. At the moment the eMail firewall is at the patent stage. The filter technology is already being used in Nutzwerk's Internet in-a-box.

Background of Loveletter
The virus is hidden in a file attachment of an eMail with the subject ILOVEYOU. The eMail promises a love letter for the recipient. The text of the electronic mail contains the request "kindly check the attached LOVELETTER from me".

The attachment is a file named LOVE-LETTER-FOR-YOU.TXT.vbs. Who opens this file triggers off an avalanche of eMails that can cause system failure and destroys image, video, and audio files (with the extensions .jpg, .jpeg, .mp3, and .mpg).

This vicious attack only affects computers with Microsoft programs. The virus uses the eMail programs Outlook and Exchange for spreading. The destruction on the computer itself is done using Windows programming languages (Visual Basic and Windows Hosting Script).