Virus advisory from SecureData: "W97M_Resume.A"

SecureData, the exclusive distributors of Trend Micro, a leading provider of Internet Content Security, announced the discovery of W97M_Resume.A - a worm which spreads through Outlook email and can delete all files in selctected directories. SecureData is offering immediate protection with updates pattern file #715, and the HouseCall free online virus scanner.

First reported in the late afternoon yesterday in the United States, the virus has the potential to spread rapidly through user's email. The virus, hidden in a document called "Explorer.doc" is delivered in a message with the subject header "Resume-Janet Simons', and the message beginning, "Attached is my resume with a list of references contained within." Once opened, the virus activates and attempts to save itself on the local drive, mail itself to all users in the Outlook address book, and activate a destructive payload, deleting all files in the C:\\Windows\, C:\WINDOWS\SYSTEM\, C:\\WINNT\, C:\\WINNT\SYSTEM32\, and C:\My Documents directories, as well as in other root directories. This payload renders the system unusable.

Trend Micro has determined this virus to be currently "in-the-wild". Eight US corporate sites have reported the virus representing over 20,000 users. Among these it is not known how many users have been affected. All computers users are encouraged to immediately delete the virus attachment if received and filter out any emails with the attachments "Explorer.doc" and with subject header "Resume-Janet Simons".

SecureData customers are strongly recommended to update their virus protection software with the latest virus pattern file updates from our website at http://www.sd.co.za. Pattern file #715 or higher will detect and clean the W97M_Resume.A virus file. Virus pattern files will continue to be updated throughout the virus alert period as new information is known or new variants are detected. Manual scans of affected mail servers, file servers, and PCs should be executed as soon as possible.

Organisations who do not currently use Trend Micro products may download a free evaluation copy of ScanMail for Exchange/InterScan VirusWall/ServerProtect plus the latest virus pattern file to clean their mail/groupware server/desktops. Also available for desktop virus protection for Trend Micro's free on-line scanning service, HouseCall, found at http://housecall.antivirus.com.