Microsoft drafts allies to squash worms

Microsoft has formed a virus information alliance with antivirus software makers Network Associates and Trend Micro.

The alliance, announced Monday, is designed to create a central resource for information on viruses that target Microsoft software, a move that coincides with the appearance of a worm with a bogus Microsoft.com identifier that is working its way through the Internet.

"We are focused on security and getting information out as soon as possible," said Andy Erlandson, director of security for product support services at Microsoft. "We plan to do updates when we have new information, and the updates could be hourly.

The Virus Information Alliance Web site has been set up to carry latest incident reports on viruses with severity ratings of moderate to high; consumer security updates; best practices for infections and denial of service attacks; tools; and antivirus resources.

The alliance will tap Network Associates' Anti-Virus Emergency Response Team, a research group that uses the company's McAfee AutoImmune technology to detect infections. It also includes Trend Micro's TrendLabs, which monitors potential security threats and develops ways to terminate new viruses.

In the future, the Web site will feature white papers and online resources on virus trends, Erlandson said. It may also offer jointly produced patch-management guidance for these trends.

"We plan to produce materials as we start to see issues emerge with a pattern to them," Erlandson said. "For example, we may start to see several types of worms that are the same thing, but they're just under different names."

Although the joint Web site will not include downloads from Network Associates and Trend Micro, there will be links to their company sites for additional information on specific issues, Erlandson said.

He added that the alliance is hoping to draft additional partners in the future.

The newly minted partnership is already being put to the test with the spread of the Palvh, or Mankx, worm, which carries the bogus e-mail address [e-mail]. By Monday, the alliance site had been updated to include a warning on the virus.