Johannesburg, 21 Oct 1999
Symantec today announced that the researchers at the Symantec AntiVirus Research Center (SARC) have analysed and posted a virus definition set to protect against the W97M.Melissa.U(Gen1) virus. The W97M.Melissa.U(Gen1) virus is a modified version of another virus that was discovered last week named W97M.Melissa.U. Both viruses are variants of the infamous W97M.Melissa, a virus that infected PC users world-wide in late March 1999.
When the new variant, W97M.Melissa.U(Gen1) infects other files, they will become infected with W97M.Melissa.U. It will however e-mail itself as W97M.Melissa.U(Gen1) when sending itself to other systems. It is critical that users have protection against both variants to keep their systems safe. Symantec was the first anti-virus vendor to provide protection against both W97M.Melissa.U and W97M.Melissa.U(Gen1).
Both Melissa variants attempt to delete some system files, insert text into documents and e-mail the infected file to the first four entries in the users MicrosoftOutlook address book.
"The Melissa virus and its variants have the ability to self-replicate through e-mail which means that the virus can spread very quickly, especially within corporations utilising large address lists," says Jako Voges, Marketing Manager of Symantec`s Middle East and Africa region. "Our team of dedicated virus researchers backed by Symantec`s state-of-the-art automated technology, were able to turn around a cure for the virus very quickly to ensure that our customers received protection from the virus before being infected."
Characteristics of Infection
The document infected with W97M.Melissa.U(Gen1) will arrive in an e-mail with the following subject line and text body with a Microsoft Word document attachment:
Subject: pictures <USERNAME>
Body: what`s up?
The username will be the name registered in the local copy of Word. For example, it may be Subject: pictures John Doe.
Virus Payload
Those infected with the virus will experience the following:
1. The virus will attempt to use Microsoft Outlook to e-mail a copy of the infected document to up to four e-mail addresses (this may include an e-mail address that contains an entire address book). Corporations using Microsoft Exchange are the primary targets of 97M.Melissa.U(Gen1) because the virus searches for Outlook`s address book.
2. The virus will insert the following text into the active document. Please Check Outlook Inbox Mail.
3. The virus will delete the following files when the infected file is opened making the system un-bootable:
. c:command.com
. c:io.sys
. d:command.com
. d:io.sys
. c:Ntdetect.com
. c:Suhdlog.dat
. c:Ntdetect.com
. d:Suhdlog.dat
How to Protect Against the Virus
Computer users can protect their PCs by updating their virus definitions to ensure protection against both variants, and by confirming that macro virus protection is set to High in Microsoft 2000 and enabled in Word 97. Norton AntiVirus customers can currently download the virus definition set through Symantec`s LiveUpdate feature or from the Symantec Web site at www.symantec.com/avcenter/download.html.
Symantec AntiVirus Research Center (SARC)
SARC is the industry`s largest dedicated team of virus experts. With offices located in the United States, Japan, Australia, and the Netherlands, the sun never sets on SARC. The center`s mission is to provide swift, global responses to computer virus threats, proactively research and develop technologies that eliminate such threats, and educate the public on safe computing practices. As new computer viruses appear, SARC develops identification and detection for these viruses, and provides either a repair or delete operation, thus keeping users protected against the latest virus threats.
Share