-BPB

Date: Sat, 27 Mar 1999 03:53:47 -0500 (EST)
From: Bruce P. Burrell 
To: PC AntiVirus Update ,
     Macintosh AntiVirus Update 
Subject: New virus outbreak worldwide; fix for DSAV (PCs) but not yet Virex
    (Mac)

-----BEGIN PGP SIGNED MESSAGE-----

   Hello, everyone.

   A new Word Macro virus (W97M/Melissa.A) was posted to one of the "alt"
newsgroups yesterday.  Usually I don't announce every new virus, but this one
already seems to have become widespread -- probably because it can email
itself as an attachment to addressbook entries, if the email application in
use is Microsoft Outlook.

   While this virus has not been reported at U-M yet, it does seem to be very
much "out there"... in under 24 hours!

MACINTOSH USERS
   For Virex (Macintosh) users, there is not yet a fix available -- but I
expect a Virex fix in one or two days, and will announce new Virex definitions
to MACAVU as soon as they are available.  The actions of this virus on a Mac
are less well known than on a PC.  [Folks who use Macs only may wish to skip
down to the SYMPTOMS section below.]

PC USERS
   For PC users, there is an extra driver for this new virus, but the driver
will work with DSAV v.7.93 **only**, so if you have not yet upgraded, please
browse to  and click on
the lower  button, and follow the directions in the 00README document
you'll find there to obtain and install v.7.93

    A new extra driver for W97M/Melissa.A, as well as several other viruses,
is available on the U-M Virus Busters web site.  We announce new extra driver
files occasionally, and this one contains a few other viruses since our last
announcement was made.  [We haven't seen these viruses at U-M, so I didn't
feel it was necessary to send out an alert.]

   This extra driver is at:  --
you browse to that site, and then save the text that appears in the same folder 
as DSAV.


SYMPTOMS

   The main thing (right now, anyway) is the email the virus sends.

   The subject will be:
      Important Message From 

   with text:
      "Here is that document you asked for ... don't show anyone else ;-)"

   and will contain an attachment with an infected Word document.  (The file
is most often named LIST.DOC, but it could be named anything.)


   The way this virus has spread _so far_ is by email recipients launching 
the attachment, though the macro vector will certainly spread it as well.  
This leads to a very important maxim -- one I've said here before:

   ** You Should NEVER Launch An Unsolicited Email Attachment. **

   Better yet, never accept any email attachments at all, but one can't
always do that.  If, however, you never launch *any* attachments at all,
you'll be immune to this kind of attack.

   Unfortunately, even if you trust the sender of an unsolicited email
attachment or if you have requested an email attachment from someone, there is
no guarantee that it is free of malware.

   That said, I am attaching extra.drv to this message for your convenience.

   1. You have not requested this extra driver file from me.

   2. I recommend that you not accept any unsolicited attachments (even if you
      trust the sender).

   3. Therefore, I'm in the somewhat uncomfortable position of recommending
      that you not accept this attachment from me....

   4. That's why I've given you the URL above, if you want to be more
      cautious.

   5. If you want to be extra cautious, you can get the drivers from the
      source at ,
      then you'll need to get each driver for a bunch of viruses and then make
      one big file out of them -- so perhaps you'll find it safe enough -- and
      certainly easier -- to get the file from the web site, or even to trust
      me. ;-)


   I've decided that -- when I do attach extra drivers -- I should provide
extra certification that the email actually comes from me.  To do this, I've
digitally signed this message, and will sign others when they contain
attachments -- with PGP (Pretty Good Privacy, a very strong encryption and
authentication algorithm).  That's the extra "stuff" that encases this
message; in brief, one can check it to guarantee that it comes from me.  

   If you don't know about PGP but want to learn about it, see e.g.,


   

   As I mentioned above, I have chosen not to announce *every* new driver as
it becomes available; I prefer to keep traffic on these X.500 mailgroups to a
minimum.  But this virus seems like it deserves an alert, so here it is.

   I'd appreciate your opinions -- if you'd prefer that I announce each and
every new driver as I discover it, or only announce when a new version becomes
available, or if I've got it about right -- or anything else -- please let me
know!

   Thanks, everyone.

   -BPB






-----BEGIN PGP SIGNATURE-----
Version: 2.6.2

iQCVAwUBNvya4z+OtVOTx759AQEQHQP+M3E/U1AaPEbHG/7+1tN0jaZl/tcET3b/
Z1Kg4rRopPtW4HWKTbDzUTxjcFkfzUxT+0wtX/aJHHKtYknJrvyk50Zp2/BAsyb2
Dc9zFI3Lp8s2kEVVFJyyDkcTK9lr0wie+qjK0y82uIjNsTlPv8y5XOiz0CFvbBDN
H/dF1KysVzk=
=CFCQ
-----END PGP SIGNATURE-----

    [ Part 2, ""  Text/PLAIN (Name: "extra.drv")  334 lines. ]
    [ Unable to print this part. ]

[As mentioned in the text, the extra driver is available from our web site. -BPB]