Just received the following precautionary message concerning
a pernicious virus which poped up recently. I am forwarding
it to Dehaiers to be informed..
Andu H.Yohannes
=======================================================================
> Below is a press release issued today by McAfee regarding a new and
> potentially
> dangerous virus that has been found. It is a MS Word macro that not
> only
> replicates itself into your documents, but also looks for MSmail on
> your machine
> and attempts to mail infected documents to email addresses on your
> personal
> address list.
>
> Users are advised not to open attachments in messages whose subject
> line reads
> "You have GOT to read this!".
>
> MCAFEE DISCOVERS SHAREFUN VIRUS; FIRST MACRO VIRUS TO AUTOMATICALLY
> EMAIL ITSELF
> TO UNSUSPECTING VICTIMS
>
> SANTA CLARA, CALIF. (February 24, 1997) -- McAfee (Nasdaq: MCAF), the
> world's
> leading vendor of anti-virus software, today announced that its
> Anti-Virus
> Emergency Response Team (AVERT) has discovered thefirst macro computer
> virus to
> specifically target users of Microsoft's popular Microsoft Mail
> (MS-Mail) email
> software. The virus, which is called ShareFun, searches through a
> user's email
> directory and automatically generates and transmits email messages with
> virus-infected attachments.
>
> "ShareFun is the first macro virus to commandeer an electronic mail
> program and
> use that program to accelerate its own spread," said Jimmy Kuo,
> director of
> McAfee's Anti-Virus Response Team. "The virus is especially pernicious
> in that
> it tricks its recipients into believing they were sent the file by a
> trusted
> friend."
>
> How ShareFun Works
>
> ShareFun is a macro virus which infects Word for Windows versions 6 and
> 7. A
> user becomes infected with ShareFun when they open an infected Word
> document.
> Once an infected document is opened, the virus infects the user's
> Microsoft Word
> environment and then runs a self-contained random number generator
> which results
> in a 25% probability of the virus taking a secondaction. During this
> second
> action, the virus searches the user's hard disk for the presence of MS-
> Mail, an
> electronic mail program which is bundled with thepopular Microsoft
> Office suite.
> If the virus does not find MS-mail present, then it takes no action.
>
> If the virus finds MS-Mail present, it accesses the MS-Mail email
> directory,
> chooses three random email addresses out of the directory, and
> generates an
> email message to each of the recipients. As part of the email
> generation
> process, the virus attaches a ShareFun-infected Word document to the
> email and
> creates an email subject line that reads "You have GOT to read this!"
> The
> attached document is the same ShareFun-infected Word document that was
> launched
> by the user.
>
> Once the ShareFun virus finishes composing the email, it automatically
> transmits
> the virus to the three recipients, often without the knowledge of the
> originating user. Upon arrival of the email, recipients will find a
> blank mess
> age. What they will see is an attachment, which will have arrived from
> a
> trusted friend or associate, with the subject line message, 'You have
> GOT to
>
> read this!'". When the recipient double-clicks on the attached
> document, the
>
> virus will activate and infect the recipient's Microsoft Word
> environment.
>
> In addition to leveraging MS-Mail as a replication and transmission
> vehicle,
> ShareFun also infects all subsequent Word documents that are opened by
> the user
> from within Word. These infected documents can in turn infect other
> Microsoft
> Word documents as they are shared over a corporate network, transmitted
> via
> email over the Internet or corporate intranet, or shared via floppy
> disk.
>
> McAfee Customer Discovers ShareFun
>
> Researchers at McAfee's Anti-Virus Research Center (AVERT) discovered
> the virus
> the evening of Tuesday, February 18, after a McAfee customer, a major
> international retailer, submitted a sample which the customer believed
> to be a
> virus. Upon receipt of the sample, AVERT researchers began working with
> Microsoft to investigate the sample, confirm its identity as a virus,
> and
> characterize its behavior. McAfee posted a special detector for the
> ShareFun
>
> virus on its web site on Wednesday, February 19.
>
> "Microsoft is committed to working with McAfee and other anti-virus
> software
> vendors to make sure our customers have the best information and the
> best tools
> to prevent the spread of macros viruses," said Tom Williams,
> Microsoft's
> Product Manager for Microsoft Office. "This new virus does not harm
> data and
> customers should use the same precautions they've used in the past
> toprotect
> themselves: never open an attachment if you're uncertain of its origin
> , use the
> built-in tools in Microsoft Word to screen for potential viruses, and
> use an
> NCSA-certified anti-virus application at all times."
>
> McAfee Develops World's First ShareFun Virus Scanner
>
> As a public service, McAfee has developed a special update of its
> VirusScan
> software which provides an antidote for the virus. The free working
> evaluation
> version of the product can be downloaded from McAfee's web site at
> http://beta.mcafee.com/public/dosscan/betascan.zip. McAfee has also
> shared the
> virus sample with other anti-virus researchers, so that they too can
> develop
> solutions to protect their customers.
>
> McAfee Anti-Virus Researchers Provide Rapid Response to Virus Outbreaks
>
> According to market researcher IDC, McAfee's VirusScan is the world's
> most
> popular anti-virus software, selling more units that all other titles
> combined.
> As the world's leading vendor of anti-virus software, McAfee is
> considered the
> computer industry's Center for Disease Control.
>
> AVERT researchers, which are located in the U.S., Japan, France and the
> Netherlands, work 24 hours a day to analyze approximately 1,000 suspect
> files
> submitted each month by McAfee customers. In order to provide rapid
> response to
> emerging virus threats, AVERT now posts hourly beta updates for
> detectors of new
> viruses on the Internet at beta.mcafee.com. McAfee is the industry's
> only
> anti-virus vendor to provide this level of protection.
>
> McAfee Provides Industry's Most Comprehensive Protection Against
> Computer
> Viruses
>
> McAfee provides the industry's most comprehensive line of anti-virus
> software
> solutions designed to protect against computer viruses on all major
> desktop and
> network computing platforms. VirusScan is just one component in
> McAfee's
> multi-tiered virus defense family, in with McAfee has developed
> specialized
> anti-virus solutions for each potential point of network virus
> penetration.
> McAfee's anti-virus solutions include:
>
> VirusScan
> Protects DOS, Windows 3.x, Windows 95,
> Windows NT, Unix, Linux, OS/2 and Macintosh
> desktops.
> NetShield
> Protects Windows NT and NetWare servers.
> WebShield
> Protects firewall and Internet gateway environments
> by scanning all HTTP, FTP, and SMTP traffic.
> GroupScan and
> GroupShield
> Provides native anti-virus protection for Lotus
> Notes environments.
> WebScan
> Protects Windows 95 and Windows NT desktops
> from downloading virus- infected files over the
> Internet.
>
> Founded in 1989, McAfee is a leading worldwide vendor of Network
> Security and
> Management products for enterprise networks. The Company is also a
> leader in
> Internet and Web-based electronic software distribution. McAfee is
> headquartered
> in Santa Clara, California and can be reached by phone at (408)
> 988-3832 or by
> fax at (408) 970-9727. McAfee's Web address is http://www.mcafee.com.
>
> ###
>
> If anyone receives mail entitled; PENPAL GREETINGS! please delete it
> >>WITHOUT
> reading it!! This is a warning for all Internet users - there >>is a
> dangerous
> virus propagating across the Internet through an e-mail >>message
> entitled >> >>
> "PENPAL GREETINGS!". >> >> DO NOT DOWNLOAD ANY MESSAGE ENTITLED
> "PENPAL
> GREETINGS"!! >> >>This message appears to be a friendly letter asking
> you if
> you are >>interested in a penpal, but by the time you read this letter,
> it is
> >>too late. The trojan horse" virus will have already infected the boot
> >>sector
> of your hard drive, destroying all of the data present. It is >>a
> self-replicating virus, and once the message is read, it will
> >>AUTOMATICALLY
> forward itself to anyone who's e-mail address is present >>in YOUR
> mailbox! >>
> >>This virus will DESTROY your hard drive, and holds the potential to
> >>DESTROY
> the hard drive of anyone whose mail is in your in box, and >>who's
> mail is in
> their in box and so on. If this virus keeps getting >>passed, it has
> the
> potential to do a great deal of DAMAGE to computer >>networks
> worldwide!!!! >>
> >>Please, delete the message entitled "PENPAL GREETINGS!" as soon as
> you >>see
> it! And pass this message along to all of your friends, >>relatives
> and the
> other readers of the newsgroups and mailing >>lists which you are on
> so that
> they are not hurt by this dangerous >>virus!!!! >> >>Please pass this
> along to
> everyone you know so this can be stopped.
>
> ========================================================================
>
> You can find more about ShareFun (and less sensational report :)
> at http://www.kumite.com/myths
> then click on ShareFun.A technical details.
>
> The second one PENPAL GREETINGS is definitely a hoax
> (see on the same web site)
>
> François
** To UNSUBSCRIBE from dehai, send mail to: majordomo@primenet.com **
** with the following text in the body of your mail: **
** unsubscribe dehai your-email-address **