'Resume' Worms Its Way Into Corporate E-mail

Welcome Guest. | Log In| Register | Membership Benefits

May 26, 2000 (4:26 PM EDT)

'Resume' Worms Its Way Into Corporate E-mail

By Rebecca Smith Hurd,

The Janet Simonses of the world might have a hard time landing job interviews next week.

A new variant of the Melissa virus arrived in e-mail boxes late Friday afternoon as a message labeled "Resume -- Janet Simons." The attachment unleashed the "Resume.A" worm on the PCs of at least five Fortune 500 companies and several consumers, antivirus software publishers said.

Symantec, Trend Micro and McAfee.com all reported customers affected by the "resume" worm. Trend Micro said eight corporate sites, or 20,000 mailboxes, were hit by 4 p.m. PDT. Symantec and McAfee.com were reporting smaller numbers. They declined to name the affected companies.

Symantec cautioned that the worm could reach many more PC users. Carey Nachenberg, chief researcher at Symantec AntiVirus Research Center, said that the "resume" worm's ability to spread is "really high" and rated it a 4 out of 5 on his alert scale.

"It's similar to 'Melissa,' but it's only a worm, and not a worm and a virus," Nachenberg said. "Melissa was both. However, it's also damaging. Melissa was not damaging."

According to the antivirus companies, the worm is hidden in the e-mail's attachment. When a user opens the attachment, it forwards a copy of itself to everyone in the user's address book. When a user closes the attachment, it deletes files from the PC's hard drive and any other drive networked to the machine. The attachment is labeled with one of three names: "resume.doc," "resume1.doc" or "Explorer.doc."

Dan Schrader, chief security analyst for Trend Micro, said the worm erases files in the system and root directories in Windows and Windows NT. How many files it affects depends on the users' access rights.

McAfee said it notified more than 450,000 customers of the "resume" virus on Friday. It described its warning as a "medium" alert and did not expect its immediate impact to be widespread.

"We're hoping that since this new virus did not start appearing until the Friday afternoon ahead of a three-day weekend, the immediate damage will be controlled," Patti Dock, McAfee director of marketing, said in a prepared statement. "The real danger may come Tuesday morning when people return to work and open the 'Janet Simons' resume."

The technical name of the variant is w97M/Melissa.bg@MM, or simply Melissa.bg.