Email virus spreading rapidly
By Stephen Shankland
Staff Writer, CNET News.com
March 26, 1999, 5:20 p.m. PT
A new virus is actively spreading itself across the Internet, taking advantage
of users' email address
books to replicate "extremely quickly," according to one expert.
The virus, W97M_Melissa, uses a combination of Microsoft Word macros and
Microsoft Outlook to send a list of 80
pornographic Web sites. It works with either Word 97 or Word 2000, according to
antivirus companies TrendMicro,
McAfee, and Network Associates.
The program is somewhat devious in that it sends itself from the email
addresses of people who are likely to be familiar
contacts, arriving as email with the subject line "Important message from..."
followed by the sender's name. The body
says "Here is that document you asked for ... don't show anyone else ;-)." The
email includes an attached Word file
"list.doc," which includes the porn sites' addresses.
The virus doesn't appear to cause any damage to infected computers except in
rare cases when the minutes of the
current time match the date--for example at 4:26 p.m. on March 26. In this
instance, the virus will insert the Bart
Simpson quotation, "Twenty-two points, plus triple-word-score, plus fifty
points for using all my letters. Game's over. I'm
outta here," into a user's active document.
Because the virus sends itself to potentially thousands of contacts contained
in a user's address distribution list,
however, there's a possibility that the virus could overwhelm mail servers.
"We've been swamped all day with customers calling in with this," said Dan
Schrader, director of product marketing at
TrendMicro. "It's spreading extremely quickly. Twenty major corporate sites
have called us."
The virus first was spotted today, according to TrendMicro and others.
It is similar to an "autospam" virus called "Share Fun" that emerged in March
1997, Schrader said, but that virus was
buggy and not as effective. There have been viruses that spread through the
address books in the past, "but never
this effectively," Schrader said.
Network Associates estimated the virus has already hit hundreds of thousands of
computers.
Twenty of the company's largest clients were infected; one firm alone said it
had reached 60,000 computers. "The
propagation rate has been alarming," a company spokesperson said.
Tom Moske, a network administrator at USWeb/CKS, ran into the virus this
afternoon when the virus spread itself from
people in his company who had opened the attachment.
And he had cause to appreciate the devious nature of the virus, since it spread
from employees in his company spread
it to the business clients of USWeb/CKS.
"It's the most intrusive I've ever seen," he said. "This is worldwide spam."
TrendMicro said the virus can be detected using its free Web-based "house call"
service.
Because the virus spreads itself automatically, it could be termed a "worm."
The author apparently appreciated this,
remarking in the virus code: "Worm? Macro Virus? Word 97 Virus? Word 2000
Virus? You Decide!"
-------------------------------------------------------
RecOzNet2 has a page @ http://www.green.net.au/recoznet2
To unsubscribe from this list, mail [EMAIL PROTECTED], and in the body
of the message, include the words: unsubscribe announce or click here
mailto:[EMAIL PROTECTED]?Body=unsubscribe%20announce
This posting is provided to the individual members of this group without permission
from the
copyright owner for purposes of criticism, comment, scholarship and research under
the "fair
use" provisions of the Federal copyright laws and it may not be distributed further
without
permission of the copyright owner, except for "fair use."
