Date:         Sat, 27 Mar 1999 14:24:07 -0600
Reply-To:     Marshall Ruskin <mruskin@PANGEA.CA>
Sender:       Vanagon Mailing List <vanagon@gerry.vanagon.com>
From:         Marshall Ruskin <mruskin@PANGEA.CA>
Subject:      repeat message without attachement: Email virus warning and
              description
Content-Type: text/plain; charset="iso-8859-1"

The following, is a repeat message, without using an attachement, of the
urgent email virus warning I received to dayfrom a collegue from EDS.

Marshall Ruskin
84 Westy

"The virus, W97M_Melissa, uses a combination of Microsoft Word macros and
Microsoft Outlook to send a list of 80 pornographic Web sites. It works with
either Word 97 or Word 2000, according to antivirus companies TrendMicro,
McAfee, and Network Associates.
The program is somewhat devious in that it sends itself from the email
addresses of people who are likely to be familiar contacts, arriving as
email with the subject line "Important message from..." followed by the
sender's name. The body says "Here is that document you asked for ... don't
show anyone else ;-)." The email includes an attached Word file "list.doc,"
which includes the porn sites' addresses.

The virus doesn't appear to cause any damage to infected computers except in
rare cases when the minutes of the current time match the date--for example
at 3:26 p.m. on March 26. In this instance, the virus will insert the Bart
Simpson quotation, "Twenty-two points, plus triple-word-score, plus fifty
points for using all my letters. Game's over. I'm outta here," into a user's
active document.

Because the virus sends itself to potentially thousands of contacts
contained in a user's address distribution list, however, there's a
possibility that the virus could overwhelm mail servers.

"We've been swamped all day with customers calling in with this," said Dan
Schrader, director of product marketing at TrendMicro. "It's spreading
extremely quickly. Twenty major corporate sites have called us."


The virus first was spotted today, according to TrendMicro and others.

...There have been viruses that spread through the address books in the
past, "but never this effectively," Schrader said.

Network Associates estimated the virus has already hit hundreds of thousands
of computers.

Twenty of the company's largest clients were infected; one firm alone said
it had reached 60,000 computers. "The propagation rate has been alarming," a
company spokesperson said.

Tom Moske, a network administrator at USWeb/CKS, ran into the virus this
afternoon when the virus spread itself from people in his company who had
opened the attachment.

And he had cause to appreciate the devious nature of the virus, since it
spread from employees in his company spread it to the business clients of
USWeb/CKS.

"It's the most intrusive I've ever seen," he said. "This is worldwide spam."

...Because the virus spreads itself automatically, it could be termed a
"worm." The author apparently appreciated this, remarking in the virus code:
"Worm? Macro Virus? Word 97 Virus? Word 2000 Virus? You Decide!" "


__________________________________
The distance between you and I, is time.