Date: Thu, 27 Mar 1997 14:53:08 -0800
Sender: Vanagon Mailing List <vanagon@vanagon.com>
From: "Enriquez, Robert" <REnriquez@misnt.alphamicro.com>
Subject: Sharefun Virus Press Release
FYI
I know this was mentioned in earlier posts, but thought I would pass the press release anyway. All disclaimers apply.
Rob
MCAFEE DISCOVERS SHAREFUN VIRUS; FIRST MACRO VIRUS TO AUTOMATICALLY EMAIL
ITSELF TO UNSUSPECTING VICTIMS
SANTA CLARA, CALIF. (February 24, 1997) -- McAfee (Nasdaq: MCAF), the
world's leading vendor of anti-virus software, today announced that its
Anti-Virus Emergency Response Team (AVERT) has discovered the first macro
computer virus to specifically target users of Microsoft's popular
Microsoft Mail (MS-Mail) email software. The virus, which is called
ShareFun, searches through a user's email directory and automatically
generates and transmits email messages with virus-infected attachments.
"ShareFun is the first macro virus to commandeer an electronic mail program
and use that program to accelerate its own spread," said Jimmy Kuo,
director of McAfee's Anti-Virus Response Team. "The virus is especially
pernicious in that it tricks its recipients into believing they were sent
the file by a trusted friend."
How ShareFun Works
ShareFun is a macro virus which infects Word for Windows versions 6 and 7.
A user becomes infected with ShareFun when they open an infected Word
document. Once an infected document is opened, the virus infects the user's
Microsoft Word environment and then runs a self-contained random number
generator which results in a 25% probability of the virus taking a second
action. During this second action, the virus searches the user's hard disk
for the presence of MS- Mail, an electronic mail program which is bundled
with the popular Microsoft Office suite. If the virus does not find MS-mail
present, then it takes no action.
If the virus finds MS-Mail present, it accesses the MS-Mail email
directory, chooses three random email addresses out of the directory, and
generates an email message to each of the recipients. As part of the email
generation process, the virus attaches a ShareFun-infected Word document to
the email and creates an email subject line that reads "You have GOT to
read this!" The attached document is the same ShareFun-infected Word
document that was launched by the user.
Once the ShareFun virus finishes composing the email, it automatically
transmits the virus to the three recipients, often without the knowledge of
the originating user. Upon arrival of the email, recipients will find a
blank message. What they will see is an attachment, which will have arrived
from a trusted friend or associate, with the subject line message, 'You
have GOT to read this!'". When the recipient double-clicks on the attached
document, the virus will activate and infect the recipient's Microsoft Word
environment.
In addition to leveraging MS-Mail as a replication and transmission
vehicle, ShareFun also infects all subsequent Word documents that are
opened by the user from within Word. These infected documents can in turn
infect other Microsoft Word documents as they are shared over a corporate
network, transmitted via email over the Internet or corporate intranet, or
shared via floppy disk.
McAfee Customer Discovers ShareFun
Researchers at McAfee's Anti-Virus Research Center (AVERT) discovered the
virus the evening of Tuesday, February 18, after a McAfee customer, a major
international retailer, submitted a sample which the customer believed to
be a virus. Upon receipt of the sample, AVERT researchers began working
with Microsoft to investigate the sample, confirm its identity as a virus,
and characterize its behavior. McAfee posted a special detector for the
ShareFun virus on its web site on Wednesday, February 19.
"Microsoft is committed to working with McAfee and other anti-virus
software vendors to make sure our customers have the best information and
the best tools to prevent the spread of macros viruses," said Tom Williams,
Microsoft's Product Manager for Microsoft Office. "This new virus does not
harm data and customers should use the same precautions they've used in the
past to protect themselves: never open an attachment if you're uncertain of
its origin, use the built-in tools in Microsoft Word to screen for
potential viruses, and use an NCSA-certified anti-virus application at all
times."
McAfee Develops World's First ShareFun Virus Scanner
As a public service, McAfee has developed a special update of its VirusScan
software which provides an antidote for the virus. The free working
evaluation version of the product can be downloaded from McAfee's web site
at http://beta.mcafee.com/public/dosscan/betascan.zip. McAfee has also
shared the virus sample with other anti-virus researchers, so that they too
can develop solutions to protect their customers.
McAfee Anti-Virus Researchers Provide Rapid Response to Virus Outbreaks
According to market researcher IDC, McAfee's VirusScan is the world's most
popular anti-virus software, selling more units that all other titles
combined. As the world's leading vendor of anti-virus software, McAfee is
considered the computer industry's Center for Disease Control.
AVERT researchers, which are located in the U.S., Japan, France and the
Netherlands, work 24 hours a day to analyze approximately 1,000 suspect
files submitted each month by McAfee customers. In order to provide rapid
response to emerging virus threats, AVERT now posts hourly beta updates for
detectors of new viruses on the Internet at beta.mcafee.com. McAfee is the
industry's only anti-virus vendor to provide this level of protection.
McAfee Provides Industry's Most Comprehensive Protection Against Computer
Viruses
McAfee provides the industry's most comprehensive line of anti-virus
software solutions designed to protect against computer viruses on all
major desktop and network computing platforms. VirusScan is just one
component in McAfee's multi-tiered virus defense family, in with McAfee has
developed specialized anti-virus solutions for each potential point of
network virus penetration. McAfee's anti-virus solutions include:
VirusScanProtects DOS, Windows 3.x, Windows 95, Windows NT, Unix, Linux,
OS/2 and Macintosh desktops.NetShield Protects Windows NT and NetWare
servers.WebShield Protects firewall and Internet gateway environments by
scanning all HTTP, FTP, and SMTP traffic.GroupScan and GroupShield Provides
native anti-virus protection for Lotus Notes environments.WebScan Protects
Windows 95 and Windows NT desktops from downloading virus- infected files
over the Internet.
Founded in 1989, McAfee is a leading worldwide vendor of Network Security
and Management products for enterprise networks. The Company is also a
leader in Internet and Web-based electronic software distribution. McAfee
is headquartered in Santa Clara, California and can be reached by phone at
(408) 988-3832 or by fax at (408) 970-9727. McAfee's Web address is
http://www.mcafee.com.