Ironport said the average antivirus vendor took almost a day to produce "antidote" since a strange virus appeared. Sometimes, the upgrade process takes place very quickly, but in general, the user's computer system is often unsafe for hours.
For example, the update program for killing Sober worms needs 16 hours 14 minutes after the new variant was born. In contrast, the Bagle worm "tantalizes" security companies to 79:25 minutes and they also need an average of 496 hours 16 minutes to cope with Mytob.
Many groups writing dangerous software put pressure on anti-virus firms by launching many versions just a little differently. The more variations in the same virus strain, the longer the time to identify and adjust. Up to this point, Mytob relatives have released more than 100 versions.
Ironport's control of incoming / outgoing e-mail systems collects information on more than 100,000 organizations worldwide.Matt Peachey, director of Ironport in Northern Europe, said that tracking the traffic helped them discover each virus outbreak as soon as it started, because all messages containing viruses often have the same mail capacity.According to Peachey, the emergence of e-mails with attachments is about 60 -100 KB, indicating a new worm is being released.