Email Problems - Virus
Anthony Mako (ajmako@NLS.NET)
Tue, 30 Mar 1999 16:44:53 -0500
<Katherine Coates wrote>
The name of the virus is Melissa. It has struck some VERY large
corporations, including the website of our local newsradio here in
Southern California.
As always, use caution when opening your email. Especially email with
an attachment. I only open something with an attachment if I know the
sender.
</Katherine>
The dangerous act is NOT opening the email message. Since an email
message is little more than plain text, it can't do any harm in and of
itself. The reason Melissa (aka W97M/Melissa.A) relies on an
attachment is because it can't infect you if you don't launch Word.
Just like the Happy99 virus, which was usually an attachment with an
.EXE attachment, Melissa requires some action beyond simply opening an
email message.
<Katherine later added>
Sorry, I forgot to mention -- the virus attaches itself to your
friends' address books so when the email subject line comes to you it
will have your friend's name in it. This is how the virus is able to
spread itself. Each time an infected computer sends an email the
virus attaches itself to the entire address book on that computer and
sends itself to everyone in the address book.
SO, UNLESS YOU WERE EXPECTING AN ATTACHMENT FROM YOUR FRIEND, DELETE
THE EMAIL.
</Katherine>
The Melissa virus only grabs addresses from your Outlook (NOT OUTLOOK
EXPRESS!!!) address list(s) and sends itself to those addresses. If
you have more than one address list, it'll grab the first 50 addresses
from your other lists and send messages to them too. Further, if you
have email groups (an address that sends mail to lots of people
automatically) in your address list, and the groups happen to be one
of the first 50 addresses, it'll send an email to each of them as well
(imagine what it could do with a list addess like Scouts-L!).
After the macro-virus is run the first time, it writes information to
your machine's registry which effectively keeps it from sending itself
out again. IF YOU DELETE THE KEY, or the macro can't write the key,
the virus will keep sending messages every time it runs until it is
cleaned from the system.
The virus spreads by sending itself to folks in your address book
ONCE, not every time you send email. It can also spread if you share
documents over a network, via diskette, or by any means that would put
an infected Word file on an uninfected computer (i.e. sending a
proposal in an infected Word document to your boss over an Intranet,
or just copying it to a shared folder on a file server).
It appears that Melissa emails are pretty easy to spot. They all seem
to have the same subject ("Important Message from <senders name>), the
TO line of the message will list many addresses, and the body of the
message will say something like: "Here is that document you asked for
... don't show anyone else ;-)". And, of course, there will be that
Word document attachment (which is often called LIST.DOC but NOT
ALWAYS!).
<And then Cathy Porter replied>
> I only open something with an attachment if I know the sender.
And that is what is so insidious about this virus. It will come from
someone you know! The subject will say something like, "Important
Information from Katherine Coates."
Don't open attachments just because you know the person who sent it!
</Cathy>
In fact, Cathy has the best advice. If you really aren't sure whether
the attachment is infected or not, and you need to know, save the
attachment to a temporary folder (DO NOT OPEN IT!) and run it through
a virus checker. If your still not sure, open Word (NOT THE DOCUMENT)
and make sure it's set up to warn you about macros in documents you
open. Then, and only then, should you even THINK about opening the
document. If it's infected, Word should warn you about macros before
it runs them and give you a chance to disable them or close the
document without running them. If it's not infected, but contains a
macro, you'll still get a warning which lets you disable the macros.
Either way, there's plenty of information about Melissa in Woody's
Office Watch (http://www.wopr.com/ ), and on the ZDNet site
(http://www.zdnet.com/ ). Beware, ZDNet and McAfee's site were both
bogged down earlier today and it was nearly impossible to get to
anything useful.
YIS
A. J. Mako, ajmako@nls.net , Scoutmaster Troop 381
Home of the Unofficial Win95 Boy Scout Desktop Theme,
http://members.aol.com/Scouts381/
Old Portage District, Great Trail Council, BSA
"I used to be an Eagle (C-7-97), but I'll always be an Eagle (1981)"
PS: I know this is completely OFF-TOPIC for Scouts-L, but most of the
messages I saw today about this virus contained either rumors, or only
half of the story. As someone who has to deal with this sort of thing
on a daily basis, I figure, if you're going to tell someone about
something, why not tell them everything the need to know.
