Christmas virus hits big companies

It_s called the W97M/Prilissa virus. But a better name for it would be the Grinch virus. Anti-virus researchers at Network Associates Inc. said Friday that 10 Fortune 500 companies on three continents have been hit with a new virus called W97/Prilissa. Prilissa is a nasty variant on two better known attacks - the Melissa worm and the PRI virus. The virus depends on the Windows 95 and 98 operating systems and the Word 97 word processing application. IF OPENED, IT WILL E-MAIL itself to the first 50 names on a computer_s Outlook or Outlook Express e-mail client. "This is probably the fastest infection rate we_ve seen since Melissa," said Sal Viveros, anti-virus product manager at Network Associates, in Santa Clara, Calif. The virus uses macro commands similar to those of Melissa to replicate itself. But the virus itself won_t go off until Christmas day. That means it won_t have much of an impact on companies, which aren_t likely to be open on that day, even if it should go undetected. But there is a big threat to home PC users, particularly unsuspecting children logging onto the computer to play with their new games on Christmas. The Dr. Suess analogies are endless. The virus itself looks for a registry key to verify if the local system has been infected. If it hasn_t, the virus creates a Microsoft Outlook e-mail message with the subject line "Message From (Office 97 user name)" and a message body that says "This document is very Important and you_ve GOT to read this!!!" The first 50 listings from all address books are selected, along with an attachment - the infected document, whatever it is. If the date is Dec. 25, the virus runs a destructive payload to overwrite the existing C:/AUTOEXEC.BAT file with instructions to format the C: drive.