[10039] in bugtraq
Re: Melissa Macro Virus
daemon@ATHENA.MIT.EDU (Darryl Braaten)
Mon Mar 29 18:38:07 1999
Date: Mon, 29 Mar 1999 14:05:08 -0800
Reply-To: Darryl Braaten <Darryl.Braaten@SEAGATESOFTWARE.COM>
From: Darryl Braaten <Darryl.Braaten@SEAGATESOFTWARE.COM>
X-To: Brett Glass <brett@LARIAT.ORG>
To: BUGTRAQ@NETSPACE.ORG
I have been looking at the code that Nate Lawson posted. The macro does not
send mail to the first 50 people in your address book, but 50 people in
every address book you have.
Depending on how your companies Exchange server is configured you are going
to send mail to 50 * (number of address lists).
Darryl
-----Original Message-----
From: Brett Glass [mailto:brett@LARIAT.ORG]
Sent: Sunday, March 28, 1999 8:18 PM
To: BUGTRAQ@netspace.org
Subject: Re: Melissa Macro Virus
No. This key would only prevent the 50-message burst of e-mail. However, the
user's NORMAL.DOT template would still be infected. So would every document
he or she opened or created. And the moment one of those documents hit
a machine without the key that had Outlook running.... Blammo! Another salvo
of messages.
--Brett
At 12:25 PM 3/27/99 +0000, Matthew Kirkwood wrote:
>On Fri, 26 Mar 1999, Nate Lawson wrote:
>
>> 2. See if machine is already infected
>> Check HKCU\Software\Microsoft\Office\Melissa? for the string "... by
>> Kwyjibo"
>
>Surely just adding this key would provide effective safety? (Until
>modified versions hit the streets, anyway - ain't "open source" great
>:)
>
>Matthew.
