In a corner of a two-storey, humdrum office block on a modern business park just off the M5 near Gloucester, there is a room. Sealed off by thick, floor-to-ceiling panes of glass and a stout wooden door, it looks like a scaled-down version of the hi-tech bunkers typecast by Hollywood as the place from where nuclear wars are fought.
One wall is taken up by a series of large electronic screens, each constantly-bubbling an array of data and charts feeding back up-to-the-millisecond, full-colour information from command stations across three continents.
In front of the screens are three banks of computers, tended by staff who simultaneously pore over their own desktop consoles and keep a wary eye on the electronic wall, all with the sober intensity of those who believe even a moment's inattention could have nasty consequences.
Welcome to the control room of MessageLabs, a key British watchtower in the escalating global battle against computer viruses.
For two weeks, the screens have been monitoring an unprecedented global outbreak of a new email-borne virus known as SirCam. In the past, even the most virulent mass mailer worms had a life expectancy of barely 48 hours, each of them contained after the initial explosion.
But when Alex Shipp, MessageLabs' senior anti-virus technologist, arrived at his desk on Monday, the news which greeted him was not good: it was only 9am, the United States was yet to wake up, but SirCam was propagating itself faster than ever, infecting millions of computers worldwide with the help of its victims' electronic address books.
"We've never seen anything like this," Mr Shipp said. "Normally you would have expected it to fizzle out but it's worse than ever. It's going to be a bad day."
Email-borne viruses account for well over 90% of the most active strains in cyberspace. MessageLabs scans more than 3m emails on behalf of its clients every day as they cross the internet to weed out any viruses hidden within them.
MessageLabs was the first centre to detect the Love Bug worm, which heralded the era of the mass-mailer virus with a global outbreak last year that caused millions of pounds of damage to computer systems.
The company has built a unique network of powerful computers - dubbed control towers - at eight locations in the UK, mainland Europe, the US and Hong Kong, each loaded with four separate powerful virus detection packages.
As well as recognising the signatures of known viruses, these are programmed to recognise virus-like code and behaviour in emails and attachments so that previously unseen viruses can also be detected. The chances of a virus writer coming up with something completely new are slim; instead they adapt or borrow bits from previous strains, making it easier for the scanners to pick them up when they are released into the wild.
Unusual patterns
Live data from each of the towers is sent back to the Gloucester control room, where staff monitor the flow of emails and watch for unusual patterns which could give the first hint of a new threat. On Monday, there was one of them waiting for Mr Shipp. At 3.29am, one of the control towers had picked up a suspicious-looking email and flagged it up to Gloucester. The offending file was automatically sent to his computer for assessment.
The analysis is done in another anonymous office. On one side are Mr Shipp's team of technologists, on the other the team responsible for compiling the massive database of virus information. In a room at the far end, separated by a large glass screen and another door, is a self-contained computer network where viruses can be tested and deconstructed without any danger of them being accidentally released into the main system.
One of the team retreated into the room with the new virus for full analysis, while Mr Shipp skimmed through a three-page printout of the computer code for a preliminary assessment so that alerts could be posted on the internet and to the other anti-virus companies.
The company sees on average two new strains a week, the vast majority of which come to nothing, but at first glance this one looked like a threat. Apparently originating in Germany, it followed the same mass mailer model as SirCam, Love Bug and the rest. But once inside an infected computer, the worm was designed to open up a backdoor through the machine's security protection, allowing the virus writer access at will.
Although the worm was picked up easily by the MessageLabs scanners, another member of the team began analysing ways in which slight changes to the virus code might have allowed it to slip through the net. This battle is more cat-and-mouse than all-out warfare: "If we can work out how they could have got through, we can plug the gaps before the virus writers think of them," said Mr Shipp.
By the end of the day, however, the new virus had been written off as a flop and the focus was back on SirCam. With the US just coming online, more than 7,000 emails containing the worm had been picked up already by the scanners.
After a week in which activity was concentrated on the other side of the Atlantic, Europe was now in the firing line, marking a significant if unwelcome milestone in the history of the internet. For the first time the number of emails containing viruses detected by MessageLabs scanners rose above the 1 in 400 mark. Mr Shipp's prediction of a bad day had come true.
"This is officially the worst day ever on record for viruses thanks to SirCam," he said. "It has completely changed the game, but we better get used to it because there will be plenty more like it."
Bugs which baffled
Melissa The world's first email-borne virus hit cyberspace in March 1999. By today's standards it was tame, limiting its propagation to the first 50 names in its victims' address books.
Love Bug The most damaging email virus on record. Within hours of being detected in May last year, it had spread worldwide, causing havoc.
Anna Kournikova The successor to Love Bug was based on the same model but spread faster because of its clever promise of a picture of the Russian tennis star. Thousands of users opened the infected attachment
homepage Despite using the same basic tricks as its two predecessors, homepage managed to subvert millions of pounds of anti-virus protection in May. Victims faced the additional embarrassment of having hardcore porn sites popping up on their screens.
