--WebTV-Mail-1323727402-664
Content-Type: Text/Plain; Charset=US-ASCII
Content-Transfer-Encoding: 7Bit
DOROTHY
--WebTV-Mail-1323727402-664
Content-Disposition: Inline
Content-Type: Message/RFC822
Content-Transfer-Encoding: 7Bit
Received: from
mailsorter-101.iap.bryant.webtv.net (209.240.198.91) by
postoffice-121.bryant.webtv.net; Sun, 28 Mar 1999 11:24:02 -0800 (PST)
Return-Path: <DISABLED-GENIES-L-request(a)rootsweb.com>
Received: from
bl-14.rootsweb.com (
bl-14.rootsweb.com [204.212.38.30]) by
mailsorter-101.iap.bryant.webtv.net (8.8.8/ms.graham.14Aug97) with
ESMTP id LAA15589; Sun, 28 Mar 1999 11:24:01 -0800 (PST)
Received: (from slist@localhost) by
bl-14.rootsweb.com (8.9.3/8.9.3) id
LAA17708; Sun, 28 Mar 1999 11:22:53 -0800 (PST)
Resent-Date: Sun, 28 Mar 1999 11:22:53 -0800 (PST)
From: hoskin(a)uniserve.com
Message-Id: <3.0.5.32.19990328112326.007dcc40(a)pop.uniserve.com>
X-Sender: hoskin(a)pop.uniserve.com
X-Mailer: QUALCOMM Windows Eudora Light Version 3.0.5 (32)
X-Priority: 1 (Highest)
Date: Sun, 28 Mar 1999 11:23:26 -0800
Old-To: (Recipient list suppressed)
Mime-Version: 1.0
Content-Type: text/plain; charset="iso-8859-1"
Content-Transfer-Encoding: 8bit
X-MIME-Autoconverted: from quoted-printable to 8bit by
bl-14.rootsweb.com
id LAA17592
Subject: [DISABLED-GENIES-L] WARNING - "Melissa" - new worm
Resent-Message-ID: <"7x9mu.A.HUE.LGo_2"(a)bl-14.rootsweb.com>
To: DISABLED-GENIES-L(a)rootsweb.com
Resent-From: DISABLED-GENIES-L(a)rootsweb.com
Reply-To: DISABLED-GENIES-L(a)rootsweb.com
X-Mailing-List: <DISABLED-GENIES-L(a)rootsweb.com> archive/latest/256
X-Loop: DISABLED-GENIES-L(a)rootsweb.com
Precedence: list
Resent-Sender: DISABLED-GENIES-L-request(a)rootsweb.com
This warning is on my home page this morning so as I also received a
warning from my head office thought it should be passed around.
Karen
Melissa macro worms around Web
E-mail Word attachment called list.doc contains virus/worm that sends
copies of itself around Net
By Bob Sullivan
MSNBC
March 27 If you receive an e-mail with the subject line "Important message
from ... ," be suspicious. If that message comes with a Word document
attached called "list.doc," you've likely been sent the Word/Melissa macro
virus. And if you open the document, it will send 50 copies of itself to
several e-mail addresses it gleans from your personal e-mail. That gives it
the ability to propagate very quickly much quicker than the happy99.exe
worm, according to virus experts.
IF YOU'VE BEEN infected, don't feel bad experts think hundreds of
thousands of PCs might have been infected in the two days the virus has
been "in the wild." The document itself contains a list of 73 pornographic
Web sites, along with usernames and passwords for those sites. The virus
may have been unleashed on the world Friday it contains the text
"Password List for March 26, 1999."
The virus can allow documents to be e-mailed to other people without
warning, a potential security breach that should worry businesses and
governments, an expert at Carnegie Mellon University said Saturday.
"Melissa" spreads via infected e-mail and attacks computers loaded with
Microsoft's widely used Word 97 or Word 2000 programs, according to CERT -
or Computer Emergency Response Team - Carnegie Mellon's Department of
Defense-funded computer security team.
CERT first heard of the virus Friday afternoon and its members worked
through the night to analyze the virus and develop a fix, CERT manager
Katherine Fithen said.
"We're getting so many reports from across the world., that we know this is
going to be a huge problem come Monday," Fithen said.
She noted that since CERT was founded 10 years ago, this is only the second
time it has considered a virus important enough to warrant a public
announcement. The first, in 1994, warned of a virus that allowed computer
burglars to collect passwords.
SPREADING RAPIDLY
CERT has not determined where the Melissa virus originated.
Fithen said she is not allowed to say whether any governmental agency has
suffered a security breach as the result of Melissa.
Friday, a spokesman from Network Associates said the company received one
e-mail every three minutes starting at 8 a.m. from clients complaining
about the file.
"It's spreading much faster than happy99," he said.
About 60,000 users were infected at the company which made the first
complaint, said Srivhes Sampath, general manager of McAfee Online. "It
pretty much brings mail systems to a halt ... We've never seen anything
spread like this."
The Melissa macro is spreading so fast for two reasons; it sends 50 copies
of itself out after it infects a user; and, it is often able to fool
potential victims into thinking the mail came from a trusted source.
After infecting a user, the macro reads the victim's registry and gleans
the user's name. It then sends 50 copies of itself to e-mail addresses
included in that user's address book. The subject line of those mails
includes the infected user's name (it reads "Important message from [user
name]"), which often tricks potential victims into trusting the message and
opening the attached document, according to Network Associates.
The user does not know he or she is infected until an e-mail recipient
complains.
"Word/Melissa written by Kwyjibo," is the text that accompanies the macro.
The author also pokes fun at virus writers who he or she expects will argue
about the exact classification of the pest, as often happens. "Works in
both Word 2000 and Word 97. Worm? Macro Virus? Word 97 Virus? Word 2000
Virus? You Decide!"
Kwyjibo appears to be a reference to a "Simpsons" TV show episode in which
Bart Simpson wins a Scrabble game by spelling out the word Kwyjibo. The
virus also includes a line from that episode: "Twenty-two points, plus
triple-word-score, plus fifty points for using all my letters. Game's over.
I'm outta here."
--WebTV-Mail-1323727402-664--