Central Command Discovers a New Internet Worm I-Worm.XTC that Targets New Year's Day; New I-Worm.XTC Masquerades Itself as a Virus Protection Update.

Business Editors and High Tech Writers

MEDINA, Ohio--(BUSINESS WIRE)--Dec. 5, 2000

Central Command, a leading provider of PC anti-virus software and computer security services, and its partners' announced today the discovery of I-Worm.XTC, a new Internet worm that infects Windows 95/98/Me/NT/2000 computers and masquerades itself as a virus protection update. This new worm uses a new technique for replication, and can be remotely controlled through the Internet.

Unlike many common Internet worms today, the I-Worm.XTC worm does not use the infected computers email address book, as like other Internet worms, in order to replicate and send out infected e-mail message attachments. Instead, I-Worm.XTC utilizes the Temporary Internet Files folder to search though HTML and HTM files for e-mail addresses. Many of today's current antivirus protection applications only protect and warn of suspicious activity when the infected computers address book is accessed. Since this new Internet worm is using the new technique of searching-cached pages for e-mail addresses, many antivirus warning systems will not detect its presence until specific detection signatures are added for it.

"I-Worm.XTC demonstrates a new means for an Internet worm to travel," said Bogdan Dumitru, Virus Researcher for AVX antivirus software. "Additionally, I-Worm.XTC can connect to a password protected Internet Relay Chat (IRC) channel. Within the IRC channel, the worm can be silently updated and controlled by the channel operator allowing remote control of the infected computer much to the surprise to the user," concluded Dumitru.

The worm attempts to hide itself behind a standard AVX Professional antivirus icon, a method to trick the unsuspecting user to open the attachment. When the worm is started on January 1st, it will set the users default web page to http://www.therainforestsite.com.

The email message that is sent by the worm contains the following subject and message:

Subject: "AVX update notification"

Message: "Hi, We would like to notify you about the newest software
designed by SOFTWIN company. This program constantly monitors the net
for the newest viral treats and anti-virus databases. In the case some
new virus is in-the-wild, it will immediatelly ask you to download the
newest version of AntiVirus eXpert 2000 (AVX). It"s small, it"s
efficent, it's secure and powerful. No special licence is needed, it"s
freeware. We hope you enjoy AntiVirus eXpert and share it with your
friends.

Best regards
AVX developement team."

AVX Professional with integrated AVX for Office 2000 has been updated to detect and remove I-Worm.XTC. A free 30-day trial version may be downloaded from www.avx.com or obtained by contacting Central Command toll-free at 866-2-GET-AVX (866-243-8289).

About Central Command:

A leader in the anti-virus industry, Central Command, Inc., a privately held company, was founded in 1990 and serves home PC users and industrial, government, financial, education and service firms with virus protection software, services, and information. The company services customers in over 40 countries and is headquartered in Medina, Ohio.

Central Command, EVRT, Emergency Virus Response Team are trademarks of Central Command Inc. AVX and AntiVirus eXpert are trademarks of Softwin SRL, Romania. All other trademarks, trade names, and products referenced herein are property of their respective owners.