Melissa virus

[Jim Mason]

Another one to watch out for.  Leps-L members beware.

Jim Mason
jmason at ink.org

-----Original Message-----
From: Dave Rintoul <drintoul at ksu.edu>
Subject: ADMIN:W97M/Melissa virus


>Below is an update from an anti-virus site regarding a new and very
>rapidly-spreading virus. It comes in e-mailed Word97 documents, so, as
>always, it is NOT a good idea to open an attached Word document (or
>any document) that you get, especially if the attachment is not
>expected, or even mentioned in the e-mail that it comes
>with. Hopefully our listserv will escape this newest idiotic prank,
>but we are all depending on your vigilance in order for that to
>happen.
>
>There are undoubtedly other anti-virus software sites with patches or
>fixes that allow you to detect and/or remove this virus. If you use an
>anti-virus program, contact that company's web site to see what they
>are doing to help you out.  But the best way to stay clean is, as
>mentioned above, never open an attached file that is not expected or
>otherwise explained in the e-mail to which it is attached.
>
>Thanks
>
>Dave
>
>--
>Dave Rintoul, Ph.D.                           mailto:drintoul at ksu.edu
>Biology Division - KSU                           ICBM: 39.18N, 96.34W
>Manhattan KS 66506-4901                             VOX: 785-532-6663
>http://www-personal.ksu.edu/~drintoul/              FAX: 785-532-6653
>---------
>
>Espoo, Finland, March 27, 1999. - Data Fellows, one of the world's
>leading developers of anti-virus and encryption software, is warning
>computer users about a virulent and widespread computer virus found on
>Friday, March 26, 1999. This virus has spread all over the globe
>within just hours of initial discovery, apparently spreading faster
>than any other virus before. The number of infected computers so far
>is estimated at tens of thousands, and rising quickly.
>
>The virus, known as W97M/Melissa, spreads by e-mailing itself
>automatically from one user to another. The virus activates by
>modifying the user's documents, inserting comments from the TV
>series "The Simpsons". Even worse, it can send out confidential
>information from the computer without the user
>
>"We've never seen a virus spread so rapidly," comments Mikko Hypponen,
>Data Fellows' Manager of Anti-Virus Research. "We've seen a handful of
>viruses that distribute themselves automatically over e-mail, but not
>one of them has been as successful as Melissa in the real world."
>
>W97M/Melissa was initially distributed in an Internet discussion group
>called alt.sex. The virus was sent in a file called LIST.DOC, which
>contained passwords for X-rated websites. When users downloaded the
>file and opened it in Microsoft Word, a macro inside the document s
>own documents. executed and e-mailed the LIST.DOC file to 50 people
>listed in the e-mail alias file of the user. The e-mail looked as
>follows:
>
>        From: (name of infected user)
>        Subject: Important Message From (name of infected user)
>        To: (50 names from alias list)
>
>        Here is that document you asked for ... don't show anyone else ;-)
>
>        Attachment: LIST.DOC
>
>Most recipients are likely to open such a file, as it usually comes
>from someone they know.
>
>After sending itself out, the virus continues to infect other Word
>documents. Eventually, these files can end up being mailed to other
>users as well. This can be potentially disastrous, as a user might
>inadvertently send out confidential data to outsiders.
>
>The virus activates if it is executed when the minutes of the hour
>match the day of the month - for example 18:27 on the 27th day of a
>month. At this time the virus will insert the following phrase into the
>current document which the user has open in Word: "Twenty-two
>points, plus triple-word-score, plus fifty points for using all my letters.
>Game's over. I'm outta here". This text, as well as the alias name of
>the virus author, "Kwyjibo", are references to the popular "Simpsons"
>cartoon TV series.
>
>"The virus won't spread much during this weekend. We will see the
>real problem on Monday morning", continues Hypponen. "When a big
>company gets infected, their e-mail servers are seriously slowed
>down and might even crash, as people start to e-mail large document
>attachments without realising it."
>
>W97M/Melissa works with Microsoft Word 97, Microsoft Word 2000
>and Microsoft Outlook e-mail client. It can infect both Windows and
>Macintosh users. If the infected machine does not have Outlook or
>Internet access at all, the virus will continue to spread locally within
>the user's own documents.
>
>Data Fellows provides a free solution to the W97M/Melissa virus
>problem. Evaluation copies of the F-Secure Anti-Virus toolkit as well
>as an update to detect and disinfect the virus are available from the
>company's website at http://www.DataFellows.com
>
>Data Fellows is one of the world's leading developers of data security
>products. The company develops, markets and supports integrated
>anti-virus, data security and cryptography software products for
>corporate computer networks. It has corporate headquarters in San
>Jose, California and Espoo, Finland, with additional offices as well as
>partners, VARs and other distributors in over 80 countries around the
>world.
>
>For more information, contact
>
>Data Fellows, 675 North First Street, 8th floor,
>San Jose, CA 95112;
>tel 408-938-6700; fax 408-938-6701
>
>http://www.DataFellows.com or info at DataFellows.com.