Melissa Virus Gets Traced To Its Source

( 3/30/99; 5:00 PM EST)
By Amy K. Larsen, InformationWeek

Melissa, the e-mail-borne virus carrying the header "Important Message," has been traced to its roots.

Newsgroup-sniffing software from security vendor Network Associates discovered where the virus was first posted: at the alt.sex newsgroup. A search of the file spotted an origin time close to the time it was published on the newsgroup.

Network Associates researchers at thevendor's Anti-Virus Emergency Response Team (AVERT) lab identified an AOL user with the moniker "Sky Roket" as the person who first posted the virus. The FBI is searching for this person.

The Melissa virus, which sends 50 infected e-mail messages with a list of pornographic sites to recipients named in the end user's address book, first surfaced late Friday.

Late Monday, the inevitable follow-on to the Melissa virus made its first appearance. Named Papa, this new Excel virus works in a similar way to the Melissa bug. Papa arrives via e-mail, claiming to be sent by "all.net" or "Fred Cohen" in the end user's inbox, and then replicates, mailing itself to the first 60 users in the address book.

Experts said the viruses have different authors, but similar patterns, which should make it easier to come up with an antidote for a copycat bug.

Sal Viveros, group marketing manager for antivirus products at Network Associates, said he estimates millions of computers have been infected by the original Melissa virus.