Systems administrators that run major installations typically detect the change in activity patterns within a few minutes to a few hours of the spread of a rapid virus in their environment and devise local solutions to limit epidemic effects. . . . Some shut down servers or block services to give themselves time. This has the effect of preventing entry into the host by eliminating the portal of entry. The anti-virus vendors typically take from two to 12 hours to get enough of an understanding of a new strain to devise a temporary fix for it. This is then disseminated over a period of less than an hour to major sites.
Protection is only temporary.
Viruses mutate in several ways, White said. The first way is that people change them, thinking they're being unbearably clever. A second way seems to occur with MS Word viruses. Apparently in older versions of Word, when the virus copies itself, it makes a mistake, and creates a mutation of some sort. A third method results when certain kinds of viruses use a shortcut way of copying themselves by giving instructions to copy all the macros in a file to another file.