On May 26, 2000 a new variant of the Melissa Worm/Virus has been identified. One anti-virus company has claimed that this virus is widespread but this has not been confirmed by any other anti-virus company.

Resume.A is a more a worm than a virus as it does not infect any local files and simply spreads through the outlook adress book.

Resume.A is not widespread. It comes in a word document attached to a message with the following header

Subject: Resume - Janet Simons
Body: To: Director of Sales/Marketing

The worm is indeed dangerous as its payload attempts to delete all files from the following directories:

C:\*.* C:\My Documents\*.*
C:\WINDOWS\*.*
C:\WINDOWS\SYSTEM\*.*
C:\WINNT\*.*
C:\WINNT\SYSTEM32\*.*

then looping through all drives from A:\*.* to Z:\*.*

We do not believe Resume.A is a realistic large scale threat

  • the mechanism of replication is far from optimal.
  • while everyone is interested in Love, not everyone is interested in resumes...
  • a virus that kills its hosts never goes very far.

It is detected and disinfected by the fsupdates which were released May 27.

 

 

 

DataRescue 45 quai de la Dérivation 4020 Liège (Belgium) tel 32-4-3446510 fax 32-4-3446514 Please send us your questions or comments.