Melissa variant spreads via Office 2001 for Mac

Melissa variant spreads via Office 2001 for Mac

By William Jackson

GCN Staff

JAN. 22—The Melissa worm is back in a slightly sneakier format, but she doesn't seem to have the same legs she had in March 1999.

'Despite some reports, Europe has not melted down,' said Graham Cluley, senior technology consultant for Sophos Plc., the U.K. parent company of Sophos Anti-Virus Inc. of Wakefield, Mass. 'It's not an epidemic by any means.'

Antivirus companies began receiving the first reports of the Melissa variant Jan. 17, and heavier reports followed the sun across Europe. The Defense Department's Computer Emergency Response Team said Friday that it had received no reports of U.S. infection yet.

The variant usually comes in an e-mail called Anniv.doc, although it could arrive under other names. Like the original Melissa, it spreads by sending itself as an attachment to recipients from the Outlook address book of an infected PC running Microsoft Windows programs, soon overloading e-mail servers. The worm can execute in either Macintosh or Windows versions of Office applications, but antivirus programs might not recognize the Mac format.

Microsoft Corp. changed the file format in new versions of Office for Mac, and many antivirus companies have not yet incorporated the changes in their scanners.

Sophos missed it by only a couple of weeks. Cluley said Sophos would support the new 2001 formats in next month's release of its antivirus product.

Sophos and other companies are releasing patches that try to stop the new Melissa worm even though they do not recognize the format. Administrators can provide additional protection by filtering out Anniv.doc messages at gateways. Infected files might spread under other names, however.

inside gcn

  • machine learning

    Mitigating the risks of military AI

Reader Comments

Please post your comments here. Comments are moderated, so they may not appear immediately after submitting. We will not post comments that we consider abusive or off-topic.

Please type the letters/numbers you see above

More from 1105 Public Sector Media Group