More Woes for Outlook
Microsoft Outlook has been the vehicle for many worms and viruses in the past, and continues to provide mobility for computer viruses getting nastier and nastier by the day. A new virus so appropriately entitled "Killer Resume" has gained national attention, catching the eye of the FBI this past week.
This virus is described as an e-mail attachment named either "RESUME.DOC" or "EXPLORER.DOC" with the subject line of "Resume - Janet Simons." This virus first spreads itself via the Outlook contact list and then proceeds to delete all files on the users computer once the user closes the attached file.
The body of the e-mail states the following:
To Director of Sales/Marketing,
Attached is my resume with a list of references contained within. Please feel free to call or e-mail me if you have any further questions regarding my experience. I am looking forward to hearing from you.
Sincerely,
Janet Simons.
Network Associates is reporting that "Killer Resume" is a strain of the Melissa virus, which hit the Internet hard last year. The payload of the virus is rather damaging, in that it will attempt to perform the following actions:
Copy itself as C:WINDOWSStart MenuProgramsStartUpExplorer.doc Copy itself as C:DataNormal.dot Attempt to delete the follwing files in this order: C:*.** files, C:My Documents*.*, C:WINDOWS*.*, C:WINDOWSSYSTEM*.*, C:WINNT*.*, C:WINNTSYSTEM32*.*, A:*.* (which may cause an error message), B:*.* (may also cause an error), and conclude by attempting to delete all files in drives D: through Z:.
The writer of the virus placed this message in the beginning of the virus code, although the computer user will not see it printed on the screen:
'-----------------------------------------------------'
'Better You Than Me Buddy...
'... Hope You Like My vIrUs
' :)
' :(
'-----------------------------------------------------'
Anti-viral experts are worried that the long weekend due to the holiday will allow the virus to proliferate and have already stated the virus is fast-spreading and Network Associates has given it a medium-level watch.
Be sure not to open the attachment and spread the virus unknowingly to the users in your contact list. The ILOVEYOU virus caused a massive amount of damage last month, and has since sprouted several variants of the itself, including the NewLove worm discovered last week.
Microsoft was criticized earlier this week for delaying the release of a patch for Outlook that was supposed to close the security hole making it easy for self-spreading worms to propigate themselves and cause damage. It was set to be released on May 22, 2000 but was not available from Windows update until Friday May 26th.
Keep your eye out for the latest virus definitions to protect yourself from NewLove, ILOVEYOU, and Killer Resume. Visit Network Associates for more information the virus and protecting yourself from it, or visit Symantec for more information about updating the Symantec line of anti-virus software.