Sunday, March 28, 1999

Fast-spreading virus shuts down e-mail servers


It multiplies via user's address book

BY MATT RICHTEL
The New York Times

        SAN FRANCISCO — A rapidly spreading computer virus forced several large corporations to shut down their e-mail servers Friday night as it rode the Internet on a global rampage, several leading network security companies reported Saturday.

        The security companies said early reports of the virus, which is carried by e-mail, led them to believe that tens of thousands of home and busi ness computers had been infected on Friday alone. The virus reproduces itself exponentially, they said, trying to use each infected message to send 50 more infected messages.

        “This is the fastest-spreading virus we've seen,” said Srivats Sampath, general manager for the McAfee Software division of Network Associates, a Santa Clara, Calif., company that makes anti-virus software.

It looks friendly
        Network security experts said that the virus appeared to do no harm to the machines it infected and that individuals could easily disable it. But they said its purpose is to interrupt networks by replicating itself so rapidly that it overwhelms networks and e-mail servers.

        E-mail infected with the virus, which its creators call Melissa, has a topic line that begins, “Important Message From.” Next is the sender's name, which is often the name of a friend, fellow worker or someone else known to the recipient.

        The message within the e-mail is short and innocuous: “Here is that document you asked for ... don't show anyone else ;-)” Attached to it is a 40,000-byte, or 40K, Microsoft Word document named list.doc.

        When the recipient opens list.doc, the Melissa virus automatically searches for an e-mail address book. It then sends a copy of itself — the message and attachment — from the recipient to the first 50 names it finds in the recipient's address book, which accounts for the rapid acceleration across the Internet.

Fixes available
        The virus is known to spread rapidly with two popular e-mail programs, Microsoft Outlook and Microsoft Outlook Express.

        Network security administrators said they had seen no evidence that Melissa was able to open and use the address books in other e-mail programs, but they did not rule out the possibility.

        Several anti-virus software makers posted software on their Web sites that their customers can download to detect the virus-encoded message and refuse it.

        A fix for the general public was available on www.sendmail.com, the Web site of Sendmail, the Emeryville, Calif., company whose post office software is often used to direct mail on the Internet.

        Eric Allman, a co-founder of Sendmail, said he was concerned that the problem would worsen Monday morning when employees find these messages in their e-mail in boxes.

        Individuals can avoid contracting or spreading the virus by not opening the attachment that accompanies the e-mail. Opening the message alone will not cause the virus to copy the address list and send itself out.

        The virus overwhelmed employees on Friday at GCI Group, a public relations firm with offices throughout the United States.

        One contract employee, who exchanges mail with a number of company employees, said she received more than 500 messages.

        “It hosed my entire day,” said the employee, Leigh Anne Varney. “You can't print the words I used. I've never had this happen before.”

       



- Fast-spreading virus shuts down e-mail servers
Economy sails amid dangers
U.S. banana stance puzzling to Europeans
TIPSHEET
Mulch man's idea born of bad luck, great timing
Customer seems to be low priority
SMALL-BUSINESS DIARY
Cleveland brewer revives P.O.C. beer The Associated Press
PRICIEST HOMES