F-Secure warns of "Resume virus"

First published: 27^th May 2000

Outbreak of Melissa.BG might die out during long weekend

Espoo, Finland, May 27, 2000 - F-Secure Corporation, one of the world's leading developers of anti-virus and encryption software, is warning computer users of a new e- mail worm, discovered very early in the morning Central European Time, Saturday, May 27, 2000. F-Secure Anti-Virus detects and disinfects this virus as "Melissa.BG" with latest updates, downloadable from http://www.F-Secure.com

This new e-mail worm spreads itself via e-mail attachments, disguising itself as a resume, directed towards sales or marketing directors of organizations.

"This is yet another attempt to use psychological means to trick people into opening an attachment," comments Mikko Hypponen, Manager of Anti-Virus research at F-Secure Corporation. "Almost every resume sent to a company would be opened sooner or later - why wouldn't this one?"

If the recipient opens the resume document, a macro virus within it will activate and e- mail the virus further via Microsoft Outlook to all addresses in all address books. After this, the virus will wait for the user to close to document. When the document is closed, the virus will try to delete documents and system files on local drives and shared network drives, typically making the machine unbootable.

The e-mail messages sent by this virus is as follows:

    From: name-of-the-infected-user
    To: random-name-from-address-book
    Subject: Resume - Janet Simons

    Director of Sales/Marketing,

    Attached is my resume with a list of
    references contained within. Please
    feel free to call or email me if you
    have any further questions regarding
    my experience. I am looking forward
    to hearing from you.

    Sincerely,

    Janet Simons.

    Attachment: Explorer.doc

"We don't expect this to become too widespread", says Hypponen. "Again, this virus is too obvious due to the damaging payload. Also, with Monday being a holiday in the USA and many European countries, the virus outbreak might die out before people actually get back to work and at their computers."

Allan Dyer, Chief Consultant of Yui Kee Computing commented, "We have not had Melissa.BG reported in Hong Kong yet and systems administrators will have the latest updates ready on Monday so we are unlikely to see significant damage here."