Help Desk | About Us | OIT | University of Maryland

Comments on our service? Send them to the Help Desk Manager

Search Site Map Home Feedback OIT Services Admin Apps Data Warehouse Network Project NEThics Research Svcs Teach Tech Telecomm Training Viruses Web Services Browse FAQS Admin Sys Calendaring Comm Deans Docs E-mail Linux LPCR Macintosh PC StarOffice Umail Unix Virus WAM/GLUE WebCT

Alert: New Internet Worms

Last reviewed on Thursday, 21-Feb-2002 21:22:09 EST

If you have McAfee Anti-Virus and want to clean the Happy99.exe worm, click here.

If you do not have McAfee Anti-Virus, you can still remove Happy99.exe from your system by following the instructions

To get the Windows 95/98 updated files for McAfee Anti-Virus to clean the Melissa virus, click here. If you need to get the updated files for other operating systems, click here.

To get the Windows 95/98 updated files for McAfee Anti-Virus to clean the Papa virus, click here.

 Click here to learn how o disable automatic macros to protect yourself from activating the Melissa virus.

 If you don't have a copy of McAfee Anti-Virus, you can download a fully-functional evaluation copy from this

http://www.symantec.com/avcenter/venc/data/happy99.worm.html

http://www.avertlabs.com/public/datafiles/valerts/vinfo/w32ska.asp

This is a Word macro worm that will affect machines loaded with Word 97 or Word 2000, and will propagate from any machine where Microsoft Outlook is installed. The worm is transmitted via an email message which usually has the subject "Important Message From <name>," where <name> is the user from worm is being transmitted. The first part of the body of the message usually reads "Here is that document you asked for ... don't show anyone else ;-)".

The second part of the body, the attachment, is a Word document. Usually, the file is entitled "list.doc," but it could be named anything.

Once the document is opened, it makes changes to the registry and then executes macro code which in effect sends email containing the worm to the first 50 entries in any MAPI address book. It then infects the Normal.dot template (the standard template for a new Word file), thereby infecting all new Word documents the user creates.

Disabling macros in Word will prevent the worm from executing. To disable automatic macro execution, open Microsoft Word, click on Tools on the menu bar, then choose Options and then General. Place a checkmark next to the "Macro virus protection" checkbox by clicking on the checkbox. This will force Word to prompt you before executing any macros such as Melissa.

Further information about Melissa, including links to different anti-virus sites with updated anti-virus files, can be found at:

http://www.cert.org/advisories/CA-99-04-Melissa-Macro-Virus.html

http://www.symantec.com/avcenter/venc/data/mailissa.html

http://www.avertlabs.com/public/datafiles/valerts/vinfo/melissa.asp HREF="http://www.inform.umd.edu/mdk-12/help/nohoax/melissa.html">http://www.inform.umd.edu/mdk-12/help/nohoax/melissa.html

This is a copycat virus of Melissa, but instead of being propagated through an Word document attachment, it is transmitted via an Excel attachment. It's subject line differs slightly from the Melissa virus in that it usually includes the phrase "all.net and Fred Cohen."

Further information about Papa, including links to different anti-virus sites with updated anti-virus files, can be found at:

http://www.avertlabs.com/public/datafiles/valerts/vinfo/x97m-papa.asp