Melissa virus launch identified

In addition, a copycat of Melissa called "Papa" was first posted in the alt.bondage newsgroup, said Sal Viveros, group marketing manager at Network Associates.

After Network Associates heard about Melissa from a customer, its newsgroup-sniffing software was able to track down the point at which the virus first emerged, Viveros said. The company knows it was the first insertion into the world because the original file, "list.doc," had a creation date just a bit younger than the time it was inserted.

Network Associates looked at the sex-related newsgroups because of the pornographic content of the "list.doc" file originally used to spread the Melissa virus, Viveros said. The file was initially posted at 4:15 a.m. Pacific time on Friday, he said.

Sky Roket apparently has posted as far back as 1997 to other sex-related newsgroups with virus-infected files named things like "complete list of adult sites" and "complete list of cracked Web sites."

The Melissa virus spreads using a combination of Microsoft Outlook and Microsoft Word. Major antivirus companies posted updates for their virus-checkers on their Web sites. However, experts cautioned that the characteristics of the virus are changing as programmers modify the Melissa programming instructions for their own viruses.

"This is the fastest-spreading virus we've ever seen," Viveros said. "It's all over the world--Asia, Europe, South Africa, New Zealand, Holland."

Antivirus company Symantec said the speed of the Melissa propagation caught antivirus makers "off guard." While Viveros took issue with the statement, saying that Network Associates had its update available less than three hours after the company first heard of the virus, its software didn't protect against Melissa until that update was installed.

Several of Network Associates' antivirus clients were infected with Melissa, including one site that had 60,000 users infected on Friday and other that had more than half a million infected emails in its system, Viveros said.

"The writer was very clever," Viveros said. "This one is spreading rapidly because it's coming from a trusted source. Most of the other viruses use very generic text where it's easy to identify it's not from a trusted source. They don't spread as quickly." Melissa takes advantage of mailing lists in Outlook.

One of the characteristics of the virus-writing community is that authors quickly adopt innovations. Indeed, Melissa.a, similar to Melissa but with a blank subject line, has been circulating. Papa is similar, though it uses Microsoft Excel instead of Word to propagate, but Viveros said it's relatively toothless because the author "broke" the replication code so it doesn't spread as effectively as Melissa.

The quick-change nature of some viruses make them similar in some way to the human immodeficiency virus (HIV), the virus that causes AIDS. HIV's rapid mutation rate enables it to evade new detection and treatment technologies.

However, Viveros said he was confident Network Associates' software will be able to catch future variants of Melissa.

Though Melissa won't fully work on Windows computers without Outlook or on Macintoshes, the virus still can lie dormant on those machines if a user opens up a Melissa-infected Word file, Viveros said.

In that scenario, Melissa would infect the computer and the template file Word uses to create new documents. If a new Word document then were sent to Windows user who did have Outlook and Word, a new round of Melissa mailings could result.

And this time, the file it would piggyback on would be the new Word file instead of Melissa's original list of porn sites. That could be bad if the new Word document were a payroll list, for example.