Security Information

Security Information  Week 50, 1999

Introduction

During the latest months viruses have been using e-mail clients to spread themselves. The most famous one is of course W97M/Melissa.A that e-mails a copy of itself to the first 50 recipients of the Outlook address book. These viruses are now referred to as Mass Mailers, and pose an additional threat to the computer user society. Not only do they infect your system, but they also send themselves using e-mail clients, attached to their original document or attached to a new document. Needless to say, these documents may actually contain privileged and confidential information that should not become publicly available.

How to recognize

In an agreement between major anti-virus vendors, the names of viruses that are Mass Mailers got a post-fix to their name. This postfix is @mm (i.e. @MassMailer). Whenever Norman Virus Control intercepts an infected file and the virus name ends with @mm, be aware that the virus found is a Mass Mailer.

At 20 December 1999, 65 macro viruses are known to be Mass Mailers. These viruses are listed below.

X97M/Jags.A@mm X97M/Jags.B@mm X97M/Papa.A@mm X97M/Papa.B@mm X97M/War.A@mm X97M/War.B@mm X97M/War.C@mm WM/PolyPoster.A.Dropper@mm WM/ShareFun.A@mm WM/ShareFun.B@mm W97M/AntiMarc.A@mm W97M/AntiSocial.E@mm W97M/AntiSocial.K@mm W97M/Bench.E@mm W97M/Class.CN@mm W97M/Cobra.F@mm W97M/Combossa.A@mm W97M/Jany.B@mm W97M/Jim.B@mm W97M/Lucia.A@mm W97M/Melissa.A@mm W97M/Melissa.AA@mm W97M/Melissa.AB@mm W97M/Melissa.AC@mm W97M/Melissa.AD@mm W97M/Melissa.B@mm W97M/Melissa.C@mm W97M/Melissa.D@mm W97M/Melissa.E@mm W97M/Melissa.F@mm W97M/Melissa.G@mm W97M/Melissa.H@mm W97M/Melissa.I@mm

W97M/Melissa.J@mm W97M/Melissa.K@mm W97M/Melissa.L@mm W97M/Melissa.M@mm W97M/Melissa.N@mm W97M/Melissa.O@mm W97M/Melissa.P@mm W97M/Melissa.Q@mm W97M/Melissa.R@mm W97M/Melissa.S@mm W97M/Melissa.T@mm W97M/Melissa.U@mm W97M/Melissa.V@mm W97M/Melissa.W@mm W97M/Melissa.X@mm W97M/Melissa.Y@mm W97M/Melissa.Z@mm W97M/Mimir.A@mm W97M/MCK.H@mm W97M/Nail.A@mm W97M/Nail.B@mm W97M/Ping.B@mm W97M/Ping.C@mm W97M/Ping.D@mm W97M/PolyPoster.A@mm W97M/Sin.D@mm W97M/Sin.F@mm W97M/Sin.G@mm W97M/Venus.A@mm W97M/Venus.B@mm W97M/Zerg.A@mm W97M/ZMK.R@mm

Action to take

If a mass mailer macro virus has been found within your company, the system on which the virus was found was probably sufficiently protected and timely updated to prevent havoc. 

However, not all systems may be sufficiently protected or updated with the latest versions of the virus definition files (e.g. laptops that have been away from the company). These systems can still pose a threat to your environment as the mass mailing virus may be undetected on this system. An appropriate action to take is denying these systems access to the network until these systems have been updated with the latest virus definition files. Only after updating these, connection to the network should be allowed.

Per Olav Førland