-----BEGIN PGP SIGNED MESSAGE----- =============================================================================== Security Advisory CERT-NL =============================================================================== Author/Source : Xander Jansen Index : S-99-14 Distribution : World Page : 1 Classification: External Version: 1 Subject : Melissa Virus distributed in .RTF files Date : 31-May-99 =============================================================================== By courtesy of IBM ERS we received information about a possibly undetected new way of spreading the Melissa Macro Virus (see also S-99-12 ftp://ftp.surfnet.nl/surfnet/net-security/cert-nl/docs/bulletin/S-99-12 ). In this case, the virus is spread in a Word document with a filename-extension .RTF. This is not really a Rich Text Format document (RTF-documents can not contain macro's) but a Word-document named as an .RTF document. Although all major virus scanners have been updated to detect the Melissa virus, some scanners might not scan files with the .RTF extension and thus might not detect the virus in documents with the .RTF extension. CERT-NL recommends to make sure that your virus scanners scan files with the .RTF extension. =============================================================================== - --ERS-ALERT--ERS-ALERT--ERS-ALERT--ERS-ALERT--ERS-ALERT--ERS-ALERT--ERS-ALERT-- - ---EXTERNAL RELEASE---EXTERNAL RELEASE---EXTERNAL RELEASE---EXTERNAL RELEASE--- ======= ============ ====== ====== ======= ============== ======= ======= === === ==== ====== ====== === =========== ======= ======= === =========== === ======= === === === ==== === ===== === ======= ============== ===== === ===== ======= ============ ===== = ===== EMERGENCY RESPONSE SERVICE SECURITY VULNERABILITY ALERT 22 May 1999 12:00 GMT Number: ERS-SVA-E01-1999:001.1 =============================================================================== VULNERABILITY SUMMARY VULNERABILITY: Melissa virus being distributed in .RTF files PLATFORMS: Machines with Microsoft Word 97 or Word 2000 SOLUTION: Make sure your antivirus software scans files whose names have .RTF extensions THREAT: Mail handling systems could experience severe loading problems as a result of this virus' propagation =============================================================================== DETAILED INFORMATION I. Description The W97M.Melissa.A macro virus caused widespread problems in March, 1999 by overloading organizations' electronic mail handling systems as a result of its propagation. Among other actions, the virus redistributes itself by sending a copy of itself (via the infected Word document) to the first 50 addresses in each of the user's MAPI address books. If any of these addresses are mailing lists, the total number of recipients could be much higher. IBM has learned that the W97M.Melissa.A virus is again being distributed, this time in a Word document whose file name extension is ".RTF". These documents are not really RTF files, but actually Word files whose file extension has been changed. Unfortunately, many users' virus scanners are not configured to scan ".RTF" files by default, which could result in the virus not being detected. NOTE: THIS IS NOT A NEW VARIANT OF THE MELISSA VIRUS. II. Impact The potential impact of this document, if received and opened on a system whose antivirus software cannot detect it, may be as serious as the impact of the original Melissa virus outbreak in your organization. For complete information on the impact of the Melissa virus, consult http://www.cert.org/advisories/CA-99-04-Melissa-Macro-Virus.html III. Platform-Specific Threats In order to successfully propagate, the infected document must be opened with Microsoft Word 97 or Word 2000 on a system that also has Microsoft Outlook installed. HOWEVER, Microsoft Outlook does NOT have to be the mailer used to read the message. IV. Solutions All major antivirus software vendors released signature updates to detect the W97M.Melissa.A virus in March, 1999. Make sure that your antivirus software has the latest signature updates from your vendor. Make sure that your antivirus software is configured to scan files with the ".RTF" extension. Some antivirus programs do NOT scan these files by default, and may require action by you to do so. Follow the instructions provided with your antivirus software to add the ".RTF" extension to the list of file types scanned. V. Acknowledgements IBM-ERS would like to thank the Symantec AntiVirus Research Center for providing some of the information used in this advisory. =============================================================================== Copyright 1999 International Business Machines Corporation. The information in this document is provided as a service to customers of the IBM Emergency Response Service. Neither International Business Machines Corporation, nor any of its employees, makes any warranty, express or implied, or assumes any legal liability or responsibility for the accuracy, complete- ness, or usefulness of any information, apparatus, product, or process contained herein, or represents that its use would not infringe any privately owned rights. Reference herein to any specific commercial products, process, or service by trade name, trademark, manufacturer, or otherwise, does not necessarily constitute or imply its endorsement, recommendation or favoring by IBM or its subsidiaries. The views and opinions of authors expressed herein do not necessarily state or reflect those of IBM or its subsidiaries, and may not be used for advertising or product endorsement purposes. - ---EXTERNAL RELEASE---EXTERNAL RELEASE---EXTERNAL RELEASE---EXTERNAL RELEASE--- - --ERS-ALERT--ERS-ALERT--ERS-ALERT--ERS-ALERT--ERS-ALERT--ERS-ALERT--ERS-ALERT-- ============================================================================== CERT-NL is the Computer Emergency Response Team for SURFnet customers. SURFnet is the Dutch network for educational, research and related institutes. CERT-NL is a member of the Forum of Incident Response and Security Teams (FIRST). All CERT-NL material is available under: http://www.surfnet.nl/surfnet/security/cert-nl.html ftp://ftp.surfnet.nl/surfnet/net-security In case of computer or network security problems please contact your local CERT/security-team or CERT-NL (if your institute is NOT a SURFnet customer please address the appropriate (local) CERT/security-team). CERT-NL is one/two hour(s) ahead of UTC (GMT) in winter/summer, i.e. UTC+0100 in winter and UTC+0200 in summer (DST). Email: cert-nl@surfnet.nl ATTENDED REGULARLY ALL DAYS Phone: +31 302 305 305 BUSINESS HOURS ONLY Fax: +31 302 305 329 BUSINESS HOURS ONLY Snailmail: SURFnet bv Attn. CERT-NL P.O. Box 19035 NL - 3501 DA UTRECHT The Netherlands NOODGEVALLEN: 06 52 87 92 82 ALTIJD BEREIKBAAR EMERGENCIES : +31 6 52 87 92 82 ATTENDED AT ALL TIMES CERT-NL'S EMERGENCY PHONENUMBER IS ONLY TO BE USED IN CASE OF EMERGENCIES: THE SURFNET HELPDESK OPERATING THE EMERGENCY NUMBER HAS A *FIXED* PROCEDURE FOR DEALING WITH YOUR ALERT AND WILL IN REGULAR CASES RELAY IT TO CERT-NL IN AN APPROPRIATE MANNER. CERT-NL WILL THEN CONTACT YOU. ============================================================================== -----BEGIN PGP SIGNATURE----- Version: PGPfreeware 6.0.2i iQCVAwUBN1JM7PE6s6q7Tf4RAQFqLAP/Zv0BuRi7O1LLvJTV+wWryhX71Kw2Dnwu 1hLhluk0Mu8+3i1XzsAAzwTKQE/DsRPBWiaoQEuLsCEQre+1LZSNb55DWMx7zGPp vZTUKCPo/7dR0IOnZTLD5BZ6Fq9t4DJ+1Dqvgs1bG32w4DN1nlfTJ9x0CJqLVA29 ucn86Z0RlXU= =5q53 -----END PGP SIGNATURE-----