SEARCH ZDNET







Melissa victims: Could have been worse
By Christa Degnan, Jim Kerstetter and John G. Spooner
March 30, 1999
PC Week Online


Hurricane Melissa came on strong and without warning, blowing through e-mails systems across the country. Though the virus didn't cause any real damage to anyone's computer, companies, cities and counties are assessing the aftermath.

More than 100,000 users at more than 300 companies have been hit by the virus since it surfaced Friday, according to CERT. Others have become the targets of Melissa variants.

Although damage could have been worse -- the virus hit as people were heading home for the weekend -- Melissa did bring productivity to a halt at many companies, at least for a few hours. Actual dollar estimates of lost productivity were not yet available.

David Schrader, a product manager at anti-virus firm Trend Micro Inc., whose company makes millions selling software to ward off computer contaminants such as Melissa, said the virus should be a wake-up call to companies, who are increasingly depending on the Internet for their business.

"This is the first security threat that's going to have a resonant impact in terms of economics," he said. Schrader predicted that economists will see a dip in productivity when they study the week that Melissa hit, similar to the dip experienced in cities hit by a major storm.

Companies that use Lotus Notes for messaging, such as IBM, did not report problems. But most Exchange servers were not so lucky.

The city of Portland said its e-mail would be down for two or three days in Melissa's wake. Unlike corporations, which can send armies of IT professionals to eradicate the virus, cities often don't have the funds, work force or flexibility in work hours to tackle the problem right away.

The city is just now starting to automate some municipal services, so the virus didn't hit as hard as it could have, Glenn Meyer, director of Portland's IT bureau, said. "As we rely on technology more in the future for city services, I realize it's going to be a bigger problem," he said.

Reports from the trenches
Dennis Cooper, a network support technician at Dallas-based Object Space Inc., was the first to get the virus at his company Friday afternoon. "I got a list of porn sites from my boss, the director of IT" Cooper said. He immediately figured out it was a virus. "But it was too late. It had already hit accounting and sales and from there it went crazy," he said.

About half of the company's 225 employees were hit. "There are still people going from desk to desk, making sure everything's okay," he said.

The MIS department at Cognos Corp. first started noticing problems Friday afternoon, said Derek Pollitt, core technology supervisor at the company's Burlington, Mass., office. All of the company's Exchange servers, which serve more than 1,700 clients worldwide, were shut down by 5 p.m. EST. All day Saturday, Cognos' MIS department worked with representatives from Microsoft and Network Associates.

By Sunday morning, a utility was installed to clean up all of the Exchange servers. By Sunday night, all clients were cleaned one by one.

"We just opened inbound traffic," Pollitt said Monday.

The Melissa virus also hit a few PC makers, causing headaches but no major problems. A spokesman for Compaq Computer Corp. said the company was hit late Friday but took steps to eradicate it before it became a major issue.

The virus proved to be an eye-opening experience for some Dell Computer Corp. employees, according to spokeswoman Neisha Frank. Luckily, Dell's IT staff was able to contain the virus before it was able to cause major damage.

"Fortunately for us, it really had little impact on our internal operations," Frank said.

Fighting back
A number of corporations fought e-mail with e-mail.

Banyan Systems Inc. simply sent out a warning asking users to delete suspect e-mail, an official said. And GTE Internetworking Inc. sent out a massive mailing to the entire staff advising all employees to perform updates to their antivirus software and providing a description of the virus so it could be deleted if it had already made it through.

An Exchange manager at a major petroleum supplier with over 14,000 seats of the messaging software said Melissa wasn't a big deal. He said systems administrators at his firm simply addressed the antivirus update in the log-on script for users and instructed all clients on the system to log off and back on again.

"Viruses happen all the time," the administrator said. "It's an ongoing battle."

ZDNN's Lisa M. Bowman contributed to this story.

For magazine subscription savings, risk-free trial issues, newsletters, and more, click here!


Copyright (c) 1999 ZDNet. All rights reserved. Reproduction in whole or in part in any form or medium without express written permission of ZDNet is prohibited. ZDNet and the ZDNet logo are trademarks of Ziff-Davis Publishing Company.