Symantec warns of new computer worm with file damaging payload

Symantec Corp. today announced that researchers at the Symantec AntiVirus Research Center (SARC) identified W97M.Melissa.BG (alias W97.Resume.A) -- an extremely fast-spreading computer worm that uses Microsoft Outlook to e-mail itself as an attachment.

Characteriscs of infection

W97M.Melissa.BG is an Internet worm that uses Microsoft Outlook to spread itself as an attachment with the subject line "Resume - Janet Simmons" along with an attachment called "RESUME1.DOC."

Payload

W97M.Melissa.BG is a macro virus that has an unusual payload. When a user opens an infected document, the virus will attempt to e-mail a copy of the document to everyone in the user's Microsoft Outlook address book. The virus also copies itself to "C:\Data\Normal.dot" and to "C:\WINDOWS\Start Menu\Programs\StartUp\Explorer.doc."

Once the user closes the document, the virus attempts to delete the following files:

C:\*.*

C:\My Documents\*.*

C:\WINDOWS\*.*

C:\WINDOWS\SYSTEM\*.*

C:\WINNT\*.*

C:\WINNT\SYSTEM32\*.*

All files in drives A through Z

The body of the e-mail sent is as follows:

To: Director of Sales/Marketing,

Attached is my resume with a list of references contained within. Please feel free to call or email me if you have any further questions regarding my experience. I am looking forward to hearing from you.

Sincerely, Janet Simons.

Recommendations/ Protection

SARC recommends administrators filter for the attachment name and subject line immediately.

Symantec AntiVirus Research Center

SARC is one of the industry's largest dedicated team of virus experts. With offices located in the United States, Japan, Australia, and the Netherlands, the sun never sets on SARC. The center's mission is to provide swift, global responses to computer virus threats, proactively research and develop technologies that eliminate such threats, and educate the public on safe computing practices. As new computer viruses appear, SARC develops identification and detection for these viruses, and provides either a repair or delete operation, thus keeping users protected against the latest virus threats.