[tarnobrzeg-gen] Melissa Virus warning
- Melissa macro worms around Web E-mail Word attachment called list.doc
contains virus/worm that sends copies of itself around Net By Bob
MSNBC March 27 If you receive an e-mail with the subject line
message from ... ," be suspicious. If that message comes with a Word
document attached called "list.doc," you've likely been sent the
Word/Melissa macro virus. And if you open the document, it will send 50
copies of itself to several e-mail addresses it gleans from your
e-mail. That gives it the ability to propagate very quickly much
than the happy99.exe worm, according to virus experts.
It pretty much brings mail systems to a halt ... We've never seen
spread like this.
IF YOU'VE BEEN infected, don't feel bad experts think hundreds of
thousands of PCs might have been infected in the two days the virus has
been "in the wild."
The document itself contains a list of 73 pornographic Web sites, along
with usernames and passwords for those sites. The virus may have been
unleashed on the world Friday it contains the text "Password List for
March 26, 1999."
The virus can allow documents to be e-mailed to other people without
warning, a potential security breach that should worry businesses and
governments, an expert at Carnegie Mellon University said Saturday.
"Melissa" spreads via infected e-mail and attacks computers loaded with
Microsoft's widely used Word 97 or Word 2000 programs, according to CERT
or Computer Emergency Response Team - Carnegie Mellon's Department of
Defense-funded computer security team.
CERT first heard of the virus Friday afternoon and its members worked
through the night to analyze the virus and develop a fix, CERT manager
Katherine Fithen said.
"We're getting so many reports from across the world., that we know this
going to be a huge problem come Monday," Fithen said.
She noted that since CERT was founded 10 years ago, this is only the
time it has considered a virus important enough to warrant a public
announcement. The first, in 1994, warned of a virus that allowed
burglars to collect passwords.
CERT has not determined where the Melissa virus originated.
Fithen said she is not allowed to say whether any governmental agency
suffered a security breach as the result of Melissa.
Friday, a spokesman from Network Associates said the company received
e-mail every three minutes starting at 8 a.m. from clients complaining
about the file.
"It's spreading much faster than happy99," he said.
About 60,000 users were infected at the company which made the first
complaint, said Srivhes Sampath, general manager of McAfee Online. "It
pretty much brings mail systems to a halt ... We've never seen anything
spread like this."
The Melissa macro is spreading so fast for two reasons; it sends 50
of itself out after it infects a user; and, it is often able to fool
potential victims into thinking the mail came from a trusted source.
After infecting a user, the macro reads the victim's registry and gleans
the user's name. It then sends 50 copies of itself to e-mail addresses
included in that user's address book. The subject line of those mails
includes the infected user's name (it reads "Important message from
name]"), which often tricks potential victims into trusting the message
opening the attached document, according to Network Associates.
The user does not know he or she is infected until an e-mail recipient
"Word/Melissa written by Kwyjibo," is the text that accompanies the
The author also pokes fun at virus writers who he or she expects will
about the exact classification of the pest, as often happens. "Works in
both Word 2000 and Word 97. Worm? Macro Virus? Word 97 Virus? Word 2000
Virus? You Decide!"
Kwyjibo appears to be a reference to a "Simpsons" TV show episode in
Bart Simpson wins a Scrabble game by spelling out the word Kwyjibo. The
virus also includes a line from that episode: "Twenty-two points, plus
triple-word-score, plus fifty points for using all my letters. Game's
I'm outta here."
The Associated Press contributed to this report.
eGroup home: http://www.eGroups.com/list/tarnobrzeg-gen
Free Web-based e-mail groups by eGroups.com