Melissa Virus - Cleanup Efforts

[Charles]

One of my clients was hit hard with the Melissa virus. This virus is in a MS Word document that is attached to a message. When the user opens the document, the VBA application contained within activates and infects the local machine and replicates the virus by sending it out to another 50 users.

What is the best way to delete these attachements from the server? Originally, the file is called LIST.DOC but since every word document is infected after contact, whenever anyone attaches a word document, it also will replicate the virus.

Any help would be much appreciated.

[Joseph King]

Use a virus scanner that runs on the Exchange Server and cleans the virus out of the Information Store, while at the same time detecting the virus in real time as it tries to e-mail more people.

Sybari Software has Antigen for Exchange which can detect Melissa.

This will go along way to containing the virus. Then, follow up with desktop antivirus software to repair the Word environment.

For an evaluation, go to www.sybari.com. Don't forget to obtain the latest virus definition files and apply them to the evaluation copy.

Regards,

Joe King
Internet Development
Sybari Software, Inc.


------------
Charles at 3/28/99 11:04:19 AM


One of my clients was hit hard with the Melissa virus. This virus is in a MS Word document that is attached to a message. When the user opens the document, the VBA application contained within activates and infects the local machine and replicates the virus by sending it out to another 50 users.

What is the best way to delete these attachements from the server? Originally, the file is called LIST.DOC but since every word document is infected after contact, whenever anyone attaches a word document, it also will replicate the virus.

Any help would be much appreciated.

[Jean Lefevre]

I installed GroupShield 4.0.2 with 4019.dat files on the exchange server (NT 4.0 SP3 with Exchange 5.5) and everything is fine so far. GroupShield is very easy to install and integrate well with the exchange
environment. Network Associate (WWW.NAI.COM) posted an evaluation of GroupShield on their site. You may want to give it a try.

------------
Joseph King at 3/29/99 5:06:18 PM

Use a virus scanner that runs on the Exchange Server and cleans the virus out of the Information Store, while at the same time detecting the virus in real time as it tries to e-mail more people.

Sybari Software has Antigen for Exchange which can detect Melissa.

This will go along way to containing the virus. Then, follow up with desktop antivirus software to repair the Word environment.

For an evaluation, go to www.sybari.com. Don't forget to obtain the latest virus definition files and apply them to the evaluation copy.

Regards,

Joe King
Internet Development
Sybari Software, Inc.


------------
Charles at 3/28/99 11:04:19 AM


One of my clients was hit hard with the Melissa virus. This virus is in a MS Word document that is attached to a message. When the user opens the document, the VBA application contained within activates and infects the local machine and replicates the virus by sending it out to another 50 users.

What is the best way to delete these attachements from the server? Originally, the file is called LIST.DOC but since every word document is infected after contact, whenever anyone attaches a word document, it also will replicate the virus.

Any help would be much appreciated.

[Jon Langel, USNH Okinawa Japan]

You can also get a utility from Microsoft to search for character strings in the subjects of messages in your information store. It's called Message Store Sanitizer, and is available at the ftp site below:

ftp://ftp.microsoft.com/transfer/outgoing/bussys/premier/Melissa/mss

You'll need to tailor mss.ini to make it work on your server. Read the readme file and you can't go wrong. This utility can also be scheduled with the AT command.

There are also a couple of other utilities at this site, but I think this one is the most important.

------------
Jean Lefevre at 4/1/99 1:10:01 PM


I installed GroupShield 4.0.2 with 4019.dat files on the exchange server (NT 4.0 SP3 with Exchange 5.5) and everything is fine so far. GroupShield is very easy to install and integrate well with the exchange
environment. Network Associate (WWW.NAI.COM) posted an evaluation of GroupShield on their site. You may want to give it a try.

------------
Joseph King at 3/29/99 5:06:18 PM

Use a virus scanner that runs on the Exchange Server and cleans the virus out of the Information Store, while at the same time detecting the virus in real time as it tries to e-mail more people.

Sybari Software has Antigen for Exchange which can detect Melissa.

This will go along way to containing the virus. Then, follow up with desktop antivirus software to repair the Word environment.

For an evaluation, go to www.sybari.com. Don't forget to obtain the latest virus definition files and apply them to the evaluation copy.

Regards,

Joe King
Internet Development
Sybari Software, Inc.


------------
Charles at 3/28/99 11:04:19 AM


One of my clients was hit hard with the Melissa virus. This virus is in a MS Word document that is attached to a message. When the user opens the document, the VBA application contained within activates and infects the local machine and replicates the virus by sending it out to another 50 users.

What is the best way to delete these attachements from the server? Originally, the file is called LIST.DOC but since every word document is infected after contact, whenever anyone attaches a word document, it also will replicate the virus.

Any help would be much appreciated.