Vanagon EuroVan
Previous messageNext messagePrevious in topicNext in topicPrevious by same authorNext by same authorPrevious page (March 1997)Back to main VANAGON pageJoin or leave VANAGON (or change settings)ReplyPost a new messageSearchProportional fontNon-proportional font
Date:         Thu, 27 Mar 1997 14:53:08 -0800
Sender:       Vanagon Mailing List <vanagon@vanagon.com>
From:         "Enriquez, Robert" <REnriquez@misnt.alphamicro.com>
Subject:      Sharefun Virus Press Release

FYI

I know this was mentioned in earlier posts, but thought I would pass the press release anyway. All disclaimers apply.

Rob

MCAFEE DISCOVERS SHAREFUN VIRUS; FIRST MACRO VIRUS TO AUTOMATICALLY EMAIL ITSELF TO UNSUSPECTING VICTIMS

SANTA CLARA, CALIF. (February 24, 1997) -- McAfee (Nasdaq: MCAF), the world's leading vendor of anti-virus software, today announced that its Anti-Virus Emergency Response Team (AVERT) has discovered the first macro computer virus to specifically target users of Microsoft's popular Microsoft Mail (MS-Mail) email software. The virus, which is called ShareFun, searches through a user's email directory and automatically generates and transmits email messages with virus-infected attachments.

"ShareFun is the first macro virus to commandeer an electronic mail program and use that program to accelerate its own spread," said Jimmy Kuo, director of McAfee's Anti-Virus Response Team. "The virus is especially pernicious in that it tricks its recipients into believing they were sent the file by a trusted friend."

How ShareFun Works

ShareFun is a macro virus which infects Word for Windows versions 6 and 7. A user becomes infected with ShareFun when they open an infected Word document. Once an infected document is opened, the virus infects the user's Microsoft Word environment and then runs a self-contained random number generator which results in a 25% probability of the virus taking a second action. During this second action, the virus searches the user's hard disk for the presence of MS- Mail, an electronic mail program which is bundled with the popular Microsoft Office suite. If the virus does not find MS-mail present, then it takes no action.

If the virus finds MS-Mail present, it accesses the MS-Mail email directory, chooses three random email addresses out of the directory, and generates an email message to each of the recipients. As part of the email generation process, the virus attaches a ShareFun-infected Word document to the email and creates an email subject line that reads "You have GOT to read this!" The attached document is the same ShareFun-infected Word document that was launched by the user.

Once the ShareFun virus finishes composing the email, it automatically transmits the virus to the three recipients, often without the knowledge of the originating user. Upon arrival of the email, recipients will find a blank message. What they will see is an attachment, which will have arrived from a trusted friend or associate, with the subject line message, 'You have GOT to read this!'". When the recipient double-clicks on the attached document, the virus will activate and infect the recipient's Microsoft Word environment.

In addition to leveraging MS-Mail as a replication and transmission vehicle, ShareFun also infects all subsequent Word documents that are opened by the user from within Word. These infected documents can in turn infect other Microsoft Word documents as they are shared over a corporate network, transmitted via email over the Internet or corporate intranet, or shared via floppy disk.

McAfee Customer Discovers ShareFun

Researchers at McAfee's Anti-Virus Research Center (AVERT) discovered the virus the evening of Tuesday, February 18, after a McAfee customer, a major international retailer, submitted a sample which the customer believed to be a virus. Upon receipt of the sample, AVERT researchers began working with Microsoft to investigate the sample, confirm its identity as a virus, and characterize its behavior. McAfee posted a special detector for the ShareFun virus on its web site on Wednesday, February 19.

"Microsoft is committed to working with McAfee and other anti-virus software vendors to make sure our customers have the best information and the best tools to prevent the spread of macros viruses," said Tom Williams, Microsoft's Product Manager for Microsoft Office. "This new virus does not harm data and customers should use the same precautions they've used in the past to protect themselves: never open an attachment if you're uncertain of its origin, use the built-in tools in Microsoft Word to screen for potential viruses, and use an NCSA-certified anti-virus application at all times."

McAfee Develops World's First ShareFun Virus Scanner

As a public service, McAfee has developed a special update of its VirusScan software which provides an antidote for the virus. The free working evaluation version of the product can be downloaded from McAfee's web site at http://beta.mcafee.com/public/dosscan/betascan.zip. McAfee has also shared the virus sample with other anti-virus researchers, so that they too can develop solutions to protect their customers.

McAfee Anti-Virus Researchers Provide Rapid Response to Virus Outbreaks

According to market researcher IDC, McAfee's VirusScan is the world's most popular anti-virus software, selling more units that all other titles combined. As the world's leading vendor of anti-virus software, McAfee is considered the computer industry's Center for Disease Control.

AVERT researchers, which are located in the U.S., Japan, France and the Netherlands, work 24 hours a day to analyze approximately 1,000 suspect files submitted each month by McAfee customers. In order to provide rapid response to emerging virus threats, AVERT now posts hourly beta updates for detectors of new viruses on the Internet at beta.mcafee.com. McAfee is the industry's only anti-virus vendor to provide this level of protection.

McAfee Provides Industry's Most Comprehensive Protection Against Computer Viruses

McAfee provides the industry's most comprehensive line of anti-virus software solutions designed to protect against computer viruses on all major desktop and network computing platforms. VirusScan is just one component in McAfee's multi-tiered virus defense family, in with McAfee has developed specialized anti-virus solutions for each potential point of network virus penetration. McAfee's anti-virus solutions include:

VirusScanProtects DOS, Windows 3.x, Windows 95, Windows NT, Unix, Linux, OS/2 and Macintosh desktops.NetShield Protects Windows NT and NetWare servers.WebShield Protects firewall and Internet gateway environments by scanning all HTTP, FTP, and SMTP traffic.GroupScan and GroupShield Provides native anti-virus protection for Lotus Notes environments.WebScan Protects Windows 95 and Windows NT desktops from downloading virus- infected files over the Internet.

Founded in 1989, McAfee is a leading worldwide vendor of Network Security and Management products for enterprise networks. The Company is also a leader in Internet and Web-based electronic software distribution. McAfee is headquartered in Santa Clara, California and can be reached by phone at (408) 988-3832 or by fax at (408) 970-9727. McAfee's Web address is http://www.mcafee.com.


Back to: Top of message | Previous page | Main VANAGON page

Please note - During the past 17 years of operation, several gigabytes of Vanagon mail messages have been archived. Searching the entire collection will take up to five minutes to complete. Please be patient!


Return to the archives @ gerry.vanagon.com


The vanagon mailing list archives are copyright (c) 1994-2011, and may not be reproduced without the express written permission of the list administrators. Posting messages to this mailing list grants a license to the mailing list administrators to reproduce the message in a compilation, either printed or electronic. All compilations will be not-for-profit, with any excess proceeds going to the Vanagon mailing list.

Any profits from list compilations go exclusively towards the management and operation of the Vanagon mailing list and vanagon mailing list web site.