Want CNET to notify you of price drops and the latest stories?

Melissa virus launch identified

A poster called "Sky Roket" launched the Melissa virus into the wilds via the newsgroup alt.sex early Friday morning.

Stephen Shankland principal writer
Stephen Shankland has been a reporter at CNET since 1998 and writes about processors, digital photography, AI, quantum computing, computer science, materials science, supercomputers, drones, browsers, 3D printing, USB, and new computing technology in general. He has a soft spot in his heart for standards groups and I/O interfaces. His first big scoop was about radioactive cat poop.
Expertise processors, semiconductors, web browsers, quantum computing, supercomputers, AI, 3D printing, drones, computer science, physics, programming, materials science, USB, UWB, Android, digital photography, science Credentials
  • I've been covering the technology industry for 24 years and was a science writer for five years before that. I've got deep expertise in microprocessors, digital photography, computer hardware and software, internet standards, web technology, and other dee
Stephen Shankland
3 min read
A poster called "Sky Roket" launched the Melissa virus into the wilds via the newsgroup alt.sex early Friday morning, antivirus company Network Associates said today.

In addition, a copycat of Melissa called "Papa" was first posted in the alt.bondage newsgroup, said Sal Viveros, group marketing manager at Network Associates.

After Network Associates heard about Melissa from a customer, its newsgroup-sniffing software was able to track down the point at which the virus first emerged, Viveros said. The company knows it was the first insertion into the world because the original file, "list.doc," had a creation date just a bit younger than the time it was inserted.

Network Associates looked at the sex-related newsgroups because of the pornographic content of the "list.doc" file originally used to spread the Melissa virus, Viveros said. The file was initially posted at 4:15 a.m. Pacific time on Friday, he said.

Sky Roket apparently has How Melissa works posted as far back as 1997 to other sex-related newsgroups with virus-infected files named things like "complete list of adult sites" and "complete list of cracked Web sites."

The Melissa virus spreads using a combination of Microsoft Outlook and Microsoft Word. Major antivirus companies posted updates for their virus-checkers on their Web sites. However, experts cautioned that the characteristics of the virus are changing as programmers modify the Melissa programming instructions for their own viruses.

"This is the fastest-spreading virus we've ever seen," Viveros said. "It's all over the world--Asia, Europe, South Africa, New Zealand, Holland."

Antivirus company Symantec said the speed of the Melissa propagation caught antivirus makers "off guard." While Viveros took issue with the statement, saying that Network Associates had its update available less than three hours after the company first heard of the virus, its software didn't protect against Melissa until that update was installed.

Several of Network Associates' antivirus clients were infected with Melissa, including one site that had 60,000 users infected on Friday and other that had more than half a million infected emails in its system, Viveros said.

"The writer was very clever," Viveros said. "This one is spreading rapidly because it's coming from a trusted source. Most of the other viruses use very generic text where it's easy to identify it's not from a trusted source. They don't spread as quickly." Melissa takes advantage of mailing lists in Outlook.

One of the characteristics of the virus-writing community is that authors quickly adopt innovations. Indeed, Melissa.a, similar to Melissa but with a blank subject line, has been circulating. Papa is similar, though it uses Microsoft Excel instead of Word to propagate, but Viveros said it's relatively toothless because the author "broke" the replication code so it doesn't spread as effectively as Melissa.

The quick-change nature of some viruses make them similar in some way to the human immodeficiency virus (HIV), the virus that causes AIDS. HIV's rapid mutation rate enables it to evade new detection and treatment technologies.

However, Viveros said he was confident Network Associates' software will be able to catch future variants of Melissa.

Though Melissa won't fully work on Windows computers without Outlook or on Macintoshes, the virus still can lie dormant on those machines if a user opens up a Melissa-infected Word file, Viveros said.

In that scenario, Melissa would infect the computer and the template file Word uses to create new documents. If a new Word document then were sent to Windows user who did have Outlook and Word, a new round of Melissa mailings could result.

And this time, the file it would piggyback on would be the new Word file instead of Melissa's original list of porn sites. That could be bad if the new Word document were a payroll list, for example.