P3D Melissa Virus

[Bob Wier <wier@xxxxxxxxxxxxxxxxx>]

The "Melissa" virus is a macro virus - it only affects
users of Word 97, Word 2000 and Outlook. Thus, for example, my Word
5.1a is immune. Since listserv generally doesn't allow attachments
through anyway, the likelyhood of getting infected is small, 
since you'd have to download the attachement, and then read it via
one of the Word versions mentioned above. Generally speaking,
I much prefer "Eudora" (either PC or MAC) as my e-mailing
software (the "Lite" versions are free).  At any rate, note 
that Outlook *express* does NOT appear vulnerable.

There are now PC counter-measures available (see sites below) and
Mac counter-measures are expected shortly.

The "happy99" worm was much more dangerous (but only to PC users),
and hence I put in a scanner to check all messages passing thru
for it (at least, after the first one appeared here).

At any rate, I've added a Melissa counter measure to the 
procmail input scanner on calcite, so hopefully it will not
propagate through here in any case.

--BW

              Bob Wier
     mailto:wier@xxxxxxxxxxxxxxxxx
   2:41 PM Monday, March 29, 1999
        Unix/Internet Administrator
   Rocky Mountain College, Billings MT.
 keeper of the Photo-3d and Overland-Trails
mailing lists and the USA GPS Waypoint server

For more information, check

http://www.umich.edu/~wwwitd/virus-busters/

http://www.sarc.com/

http://www.datafellows.com/news/vir-news/

data fellows note:
W97M/Melissa works with Microsoft Word 97, Microsoft Word 2000 and Microsoft
Outlook e-mail client. It can infect both Windows and Macintosh users. If the
infected machine does not have Outlook or Internet access at all, the virus will
continue to spread locally within the user's own documents. 

http://vil.mcafee.com/villib/alpha.asp

http://www.ciac.org/ciac/

the authoritative CIAC source:


PROBLEM:        A new Word 97 macro virus named W97M.Melissa has been detected
                at multiple DOE sites and is known to be spreading widely. The
                virus uses Microsoft Outlook to e-mail the infected document
                to the first 50 people from each of your Outlook address books.
PLATFORM:       Windows 95 or Windows NT running Microsoft Word 97 (version 8)
                or Word 2000 (version 9) and Microsoft Outlook. Word 98 on the 
                Macintosh is probably not vulnerable because the virus uses
                the Windows registry, but that has not been verified yet.  
                Outlook Express and other mail readers are not vulnerable. 
DAMAGE:         It overwrites the first macro in open documents and in the 
                normal.dot template with the macro virus code. It turns off 
                macro detection in Word. It sends copies of the infected 
                document to up to 50 people from each of your Outlook address 
                books. 
SOLUTION:       Use an updated antivirus product. Some vendors have a solution
                available but in many cases you must go to the vendors web
                site to get it. Do not depend on the automatic or live update 
                feature of an antivirus package to get the detector for this 
                virus. Additional precautions are to password protect the 
                normal.dot file, turn on macro virus detection in Word, and DO 
                NOT OPEN attachments to mail messages with the subject 
                "Important Message From " and the contents "Here is that 
                document you asked for ... don't show anyone else ;-)" without 
                checking with the sender. Alert your computer security
                officers  if you receive such messages.



------------------------------