First published: 02nd April 1999
Hong Kong, China, April 2, 1999 - Yui Kee is co-operating with ISP's to make an updated version of F-Secure Anti-Virus software that detects and disinfects the Melissa and Papa viruses available at multiple locations for free download.The Melissa virus first appeared on Friday, 26 March and spread all over the globe within hours, apparently spreading faster than any other virus before. The developers of F-Secure, Data Fellows, had an update capable of detecting and disinfecting Melissa available for download from their Internet site within 2.5 hours of receiving a sample. Yui Kee had the same update available on their site from early Sunday morning.
The Papa virus, which has some similarities to Melissa, appeared on Tuesday, and Data Fellows was again quick to react, having an update available within 1.5 hours of receiving a sample. The update was available from Yui Kee early Wednesday morning.
A free version of F-Secure to handle Melissa and Papa has been available from Yui Kee's site since Wednesday, but the help of ISP's was sought to spread the cure faster. Allan Dyer (Technical Director, Yui Kee), commented, "The Melissa virus spread faster than anything we have seen before, we can really describe this as an epidemic. With such a spread, it is like a public health issue and it is good to see ISP's taking a responsible attitude by providing this service."
The trial version of F-Secure Anti-Virus for Windows 95 is available from (in alphabetical order):
HKNet: http://www.hknet.com/f-secure/
(this list is growing, check back here for the latest additions)
Existing F-Secure customers can download a daily-updated program to update their virus definitions, FSUPDATE.EXE at:
ftp://ftp.europe.f-secure.com/anti-virus/updates/fsupdate.exe
The first version of Papa has a serious bug and it does not work, but a fixed version, Papa.B, has since been released. There is also a second version of Melissa, Melissa.B. It is currently unclear how well these are spreading. Allan Dyer ventured, "Now that Melissa has demonstrated the effectiveness of this spreading strategy, we could see many other virus writers using the idea in their creations in the coming days and weeks. Some of these will work and others fail, but we will monitor the situation closely and provide updates via these co-operating ISP's as necessary."
More viruses that spread in this way are appearing. A virus similar to Melissa, W97M/Syndicate.A was posted to many newsgroups (including alt.sex, alt.sex.animals and alt.binaries.warez) on the 30th and 31st of March 1999. While most Internet users do not frequent these groups, the e-mailing function of the virus means that it could spread to other users very quickly, just like Melissa.
There are additional ways that users can protect themselves. These viruses send themselves as attachments to e-mail messages. The virus cannot do anything until the attachment is opened, in Word or Excel, as appropriate. Firstly, consider why you are being sent the file, is it from someone who normally sends you files? Does the message sound like that person wrote it? Using WordPad is another useful tip. WordPad is provided with Windows, and can open Word files, but it does not process any macros in a document so a macro virus would not be able to spread. Dyer recommended, "Set WordPad as your viewer for Word files in your browser and e-mail client, your technical support will be able to show you how. This does not get rid of Word viruses in e-mail attachments, they will still be there in the documents, but it does stop them spreading onto other files in your machine and slowing down the spread makes the whole problem a lot more manageable."