Tuesday, March 30, 1999

'Melissa' virus snags Bearcats fans

The Cincinnati Enquirer

        An e-mail virus called Melissa found its way into a mail list for University of Cincinnati Bearcats basketball fans, but otherwise seemed to be causing few problems for Cincinnati businesses on Monday.

        Nationally, e-mail systems at hundreds of companies were swamped by the virus, which comes labeled as an “important message” from a friend.

  • Experts advise if you encounter e-mail with the heading “important message” in the subject line, delete it from your system and don't open any attachments with the mail.
  • Information about the Melissa virus is available at:
  www.cert.org/advisories/ CA-99-04-Melissa-Macro-Virus.html.
  Microsoft has a patch available at:
  • http://www.microsoft.com/ security/bulletins/ms99-002.asp
  • Several antivirus software makers, including McAfee, Symantec, Trend Micro and Sophos posted patches on their Web sites to detect and reject the virus.
  • Latest update from Associated Press
        Experts at Carnegie Mellon University's Computer Emergency Response Team estimated that the virus caused more than 100,000 personal computers to spew out dozens of infected e-mail messages.

        Jeff Carpenter, team leader at the Pittsburgh university, said the actual infection rate was much higher.

        “We believe this is only the tip of the iceberg,” he said.

        The body of the e-mail message says “Here is that document you asked for ... don't show it to anyone else,” with a winking smiley face formed by the punctuation marks ;-).

        The virus breaks into the address book of a computer user's e-mail program and makes the incoming e-mail look like it is from a friend or colleague.

        Attached to the message is a document file in the popular Microsoft Word processing program. Once the user opens that file, the virus again digs into the address book, finds the first 50 addresses and sends the same infected documents out into cyberspace.

        However, the virus apparently causes no permanent damage to a computer's memory or programs.

        Steve Pollock, founder and technical manager for PC On Call, a Cincinnati computer repair service, said, “We haven't got a lot of calls about the virus. People know about it because of all the media publicity over the weekend, and a lot of companies have installed filters to prevent it from entering their networks.”

        Among them: Cincinnati Bell, which installed a filter to catch and clean the e-mail virus from its system. It also sent messages to employees warning them about the virus.

        Representatives of GE Aircraft Engines and Cincom Systems Inc. said Monday they weren't aware of any instances of the virus affecting their systems.

        Nationally, organizations affected include: the chemical company DuPont in Wilmington, Del.; the aerospace company Lockheed Martin in Bethesda, Md.; electronics products maker Hon eywell Inc. in Minneapolis; the North Dakota state Capitol; the Associated Press Broadcast Services in Washington, D.C.; and Compaq Computer Corp. in Houston.

        PC On Call found the virus close to home when Dan Marshall, director of business development and member of a Cincinnati Bearcats e-mail list, was sorting through personal messages Monday morning.

        “There were a couple of messages from the Bearcat basketball list saying if I got something labeled “important message” not to open it, and sure enough a couple messages earlier was a message labeled “important message” from somebody I didn't know,” said Mr. Marshall.

        “I knew enough not to open it, but I told Steve, "I've got it. I've got it,” Mr. Marshall said.

        The Bearcats basketball list, which has about 350 members, isn't affiliated with the university, but was set up by a fan in California with his own server.

        Brian McCann, a UC sports information director, found seven messages warning him about the e-mail virus while he was sorting through his messages Monday afternoon.

        UC spokesman Greg Hand said the university's e-mail experts sent out an advisory over the weekend to 2,700 users on its administrative network to look out for the virus.

        As of Monday, he said, they were aware of only “four or five” instances where the mail had been received and only one instance where it had been passed on.

        He said the university was also checking its Bearcats online system, used by students and faculty, but hadn't encountered problems.

Latest update from Associated Press

- 'Melissa' virus snags Bearcats fans
10,000 reflects faith in economy
Dow clinches 1st 10,000+ close
Mail meters take licking
Local firm wins Net security deal
Microsoft balks at turning over system blueprints
P&G moving 900
LensCrafters files contract suit
Oil focus made Arco a tempting takeover target