 |
 |
Ok, everyone, there's a new copycat (of Melissa) virus out there. (I "reply"'d, not forwarded, so there's not attachment this time.) --Renee > Network Associates has discovered an e-mail virus similar to the Melissa > virus that company officials said they believe is even more dangerous than > its predecessor. > > Dubbed Papa, the new virus is an Excel virus that sends itself in the same > manner as Melissa, but sends itself to the first 60 people in a user's > address book, whereas Melissa sends itself to the first 50. In addition, > Papa sends an e-mail every time the virus is activated. Melissa sends a > message only the first time it is opened. > > The subject line for e-mail carrying Papa claims the message is from > "all.net and Fred Cohen." The body of the e-mail, which contains an > attached document titled "path.xls," then instructs the user not to disable > the macros, which is how the virus is activated. > > According to Sal Viveros, group marketing manager for Total Virus Defense > at Network Associates, the most disruptive aspect of Papa is the fact that > it "pings" an as-yet-undetermined external site to make sure there is an > available Internet connection. The practice of pinging is not unusual, but > Papa pings so many times that it brings a network down. > > The biggest corporate security concern is that any document infected with > the virus and then e-mailed to another party is distributed in the same way > as the Melissa virus, leaving companies vulnerable to having confidential > documents distributed unknowingly. > > Viveros believes Papa was written by a different person than the author of > Melissa, but that it uses the original virus as a road map. This practice > of using similar mechanisms to deliver more destructive payloads is not > unusual, noted Viveros, which could mean a string of such copycat viruses > could be on the way. Variants, however, should be less disruptive because > virus-detection vendors know what they are looking for. > > Network Associates expects to post software for detection and cleaning of > the Papa virus by Monday afternoon. > %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%