----------------------------------------
New Melissa offshoot: 'Mad cow' virus
----------------------------------------
By Lisa M. Bowman , ZDNN

Yet another variant of the nasty Melissa virus has surfaced on the
Internet, this one with the subject line "Mad cow joke."

The new mad cow joke virus is unrelated to other so-called Mad Cow viruses
that have surfaced in the past, according to anti-virus company Trend
Micro Inc. The new virus is similar to Melissa in that it surfaces when
users open a Word document attached to an e-mail, triggering e-mail to the
top entries in an Outlook user's address book.

Unlike Melissa, which sends out 50 messages, this one sends out only 20.
Also, it is a member of a group of viruses known as "class viruses," which
store code in a different -- and harder-to-detect -- portion of a Word
document.

The virus comes with a subject line "Mad cow joke," a body containing the
words "beware of the speed of the Mad cow," and an attached file called
madcow.doc.

The virus' creator even tipped his or her hat to Melissa. The last lines
of code in the Mad cow virus reads: "word/veronicathankstoword/
melissaandword/class."

Dan Schrader, Trend Micro's product manager, believes a host of variant
viruses will surface in the wake of Melissa. "We're going to see a lot of
them," Schrader said. "It's unfortunate these guys need to copycat."

Most anti-virus firms have updated their software to ward off variants.
Because those roadmaps in the variants are similar to the original virus,
most anti-virus software can detect and exterminate them.

The FBI has launched a widespread search for Melissa's creator, whom
officials said could face as many as 10 years in jail and $350,000 in
fines.

Meanwhile, anti-virus researchers also are learning new details of the
so-called Papa virus, a Melissa variant that is carried by Excel documents
and sends out 60 e-mails when opened.

The virus contains the subject line "Fwd: Workbook from all.net and Fred
Cohen" and a body reading "Urgent info inside. Disregard macro warning."

The Papa virus first surfaced Monday, but after studying it, researchers
found a glitch that kept it from working, rendering it "sterile."

But Tuesday, someone apparently had fixed that glitch, and the newer,
virulent strain of virus -- "Papa B" -- was reportedly on the loose.

Anti-virus software maker Network Associates said it's had reports of Papa
B hitting at least one Fortune 100 company and two large firms in Europe.

When opened, the virus also pings -- or, repeatedly hits -- two Web sites,
one run by anti-virus expert Fred Cohen, the subject of the virus message,
and @Home.

Cohen suspects a group of hackers created the virus to target him because
he fingered them in another virus, which was called Caligula. "They have
made threats over the last several weeks," Cohen said.

To protect himself from such attacks, Cohen said he simply says "no" to
any attachment that comes his way.

Still, he believes that Microsoft Corp. cuts too many security corners in
Windows, oversights that could lead to more breaches. The Melissa virus
and its variants have been carried through Microsoft documents.

GoStats stats counter

Friday, January 12, 2007

© Dancom Industries
All Rights Reserved

Home