Variant of 'Melissa' virus surfaces

From...

by Joris Evers

(IDG) -- Computer virus watchers are warning of a variant of the infamous "Melissa" virus that slips by detection software because of an altered file format.

Santa Clara, Calif.-based McAfee, a division of Network Associates, said this week that it has received 20 reports of the virus, dubbed "Melissa.w", striking in the last 48 hours. Hits have been reported in both Europe and the U.S.

McAfee has rated this variant of Melissa as a "low to medium risk," which means it is not yet viewed as being as threatening as the original version of the virus, which is still rated "high risk."

	MESSAGE BOARD
Security on the Net

"It's exactly the same source as the original Melissa virus, only the file format has changed," said Patrick Nolan, virus researcher at McAfee Avert, Network Associates' virus research center.

Nolan said the format changed because somebody with an infected system forwarded a document in Microsoft's new Word 2001 format. "It is possible that the virus is not detected; the binary storage of macros is slightly different [in the new file format]," he explained.

IDG.net INFOCENTER InfoWorld Main Page InfoWorld Test Center Subscribe to InfoWorld Newsletters Infoworld Opinions and Spotlights Related IDG.net Stories How a computer virus works Another Melissa-like virus makes the rounds Melissa spawns deadly offspring

Melissa was first discovered in March 1999. The virus quickly spread by forwarding itself using the address book of Microsoft's Outlook e-mail program installed on the victim's computer. The variant spreads in exactly the same way.

Nolan said the virus affects systems running Windows or Apple Computer's Macintosh operating system and Office 97, Word 98, Office 2000 or Office 2001.

Melissa.w arrives at a user's computer in an e-mail with the subject line "Important Message From," and " Here is that document you asked for ... don't show anyone else ;-)," in the body of the message, just like the original Melissa.

In most instances reported to McAfee a file named "anniv.doc" was attached, said Nolan. The original virus was hidden in a document named "list.doc". The virus is activated when the file is opened.

Melissa spawns dangerous offspring
October 15, 1999
Despite fending off Melissa virus, U.S. systems still vulnerable
April 16, 1999
Protect yourself from the next Melissa
April 5, 1999
Man charged with unleashing 'Melissa' computer virus
April 2, 1999
Melissa takes down Marine Corps e-mail
March 31, 1999

How a computer virus works
(PCWorld.com)
Another Melissa-like virus makes the rounds
(InfoWorld.com)
Melissa spawns deadly offspring
(InfoWorld.com)
What you didn't get for Christmas: viruses
(InfoWorld.com)
Melissa creator pleads guilty
(InfoWorld.com)
Sophos ranks year's ten most troubling viruses
(IDG.net)
Variant of 'I Love You' virus attacks
(IDG.net)
McAfee antivirus update gives NT 4.0 the flu
(IDG.net)

McAfee.com

Note: Pages will open in a new browser window

External sites are not endorsed by CNN Interactive.