While systems administrators are still trying to sort out the effect of the Melissa virus, a leading vendor of antivirus software has discovered a similar virus that could be even more dangerous.
Network Associates late Monday said the new virus, nicknamed Papa, is an Excel virus that is transmitted in the same manner as Melissa. What’s worse is instead of sending itself to the first 50 people in a Microsoft Outlook address book, the virus is sent to the first 60. Papa also sends an e-mail every time the virus is activated whereas Melissa only sends a message the first time it is opened.
E-mails containing the Papa virus commonly contain the subject “all.net and Fred Cohen.” The e-mail also contains an Excel attachment with the file name “path.xls.” Once the attachment is opened, Microsoft Word will ask whether or not it should disable macros. Replying yes stops the e-mail from being sent to those listed in an Outlook address book.
Network Associates said the worst thing about Papa is the fact it “pings” an undetermined external site to ensure an Internet connection is active. The virus pings the site so many times that it takes down the network. It also lowers the security settings on infected systems.
Documents infected with the Papa virus are spread just as documents infected with Melissa. Network Associates virus experts believe Papa was not authored by the same person as Melissa, but they do believe it was patterned after the original virus. The fact that the two do share common traits is making it easier for antivirus software vendors to craft a way to detect and clean them. Network Associates is currently working on a fix for Papa and has already posted a fix for Melissa..
Systems most at risk are Microsoft Exchange servers running Microsoft Outlook.
Systems administrators across the country were feeling the effects of Melissa Monday and the FBI confirmed its computer crimes unit was launching an investigation into the attack.
