Mcafee Discovers Sharefun Virus; First Macro Virus To Automatically Email Itself To Unsuspecting Victims

Business Wire, Feb 24, 1997

SANTA CLARA, Calif.--(BUSINESS WIRE)--Feb. 24, 1997--McAfee (NASDAQ: MCAF), the world's leading vendor of anti-virus software, today announced that its Anti-Virus Emergency Response Team (AVERT) has discovered the first macro computer virus to specifically target users of Microsoft's popular Microsoft Mail (MS-Mail) email software. The virus, which is called ShareFun, searches through a user's email directory and automatically generates and transmits email messages with virus-infected attachments.

"ShareFun is the first macro virus to commandeer an electronic mail program and use that program to accelerate its own spread," said Jimmy Kuo, director of McAfee's Anti-Virus Response Team. "The virus is especially pernicious in that it tricks its recipients into believing they were sent the file by a trusted friend."

How ShareFun Works

ShareFun is a macro virus which infects Word for Windows versions 6 and 7. A user becomes infected with ShareFun when they open an infected Word document. Once an infected document is opened, the virus infects the user's Microsoft Word environment and then runs a self-contained random number generator which results in a 25% probability of the virus taking a second action. During this second action, the virus searches the user's hard disk for the presence of MS-Mail, an electronic mail program which is bundled with the popular Microsoft Office suite. If the virus does not find MS-mail present, then it takes no action.

If the virus finds MS-Mail present, it accesses the MS-Mail email directory, chooses three random email addresses out of the directory, and generates an email message to each of the recipients. As part of the email generation process, the virus attaches a ShareFun-infected Word document to the email and creates an email subject line that reads "You have GOT to read this!" The attached document is the same ShareFun-infected Word document that was launched by the user.

Once the ShareFun virus finishes composing the email, it automatically transmits the virus to the three recipients, often without the knowledge of the originating user. Upon arrival of the email, recipients will find a blank message. What they will see is an attachment, which will have arrived from a trusted friend or associate, with the subject line message, "You have GOT to read this!". When the recipient double-clicks on the attached document, the virus will activate and infect the recipient's Microsoft Word environment.

In addition to leveraging MS-Mail as a replication and transmission vehicle, ShareFun also infects all subsequent Word documents that are opened by the user from within Word. These infected documents can in turn infect other Microsoft Word documents as they are shared over a corporate network, transmitted via email over the Internet or corporate intranet, or shared via floppy disk.

McAfee Customer Discovers ShareFun

Researchers at McAfee's Anti-Virus Research Center (AVERT) discovered the virus the evening of Tuesday, February 18, after a McAfee customer, a major international retailer, submitted a sample which the customer believed to be a virus. Upon receipt of the sample, AVERT researchers began working with Microsoft to investigate the sample, confirm its identity as a virus, and characterize its behavior. McAfee posted a special detector for the ShareFun virus on its web site on Wednesday, February 19.

"Microsoft is committed to working with McAfee and other anti-virus software vendors to make sure our customers have the best information and the best tools to prevent the spread of macros viruses," said Tom Williams, Microsoft's Product Manager for Microsoft Office. "This new virus does not harm data and customers should use the same precautions they've used in the past to protect themselves: never open an attachment if you're uncertain of its origin, use the built-in tools in Microsoft Word to screen for potential viruses, and use an NCSA-certified anti-virus application at all times."

McAfee Develops World's First ShareFun Virus Scanner

As a public service, McAfee has developed a special update of its VirusScan software which provides an antidote for the virus. The free working evaluation version of the product can be downloaded from McAfee's web site at http://beta.mcafee.com/public/ dosscan/betascan.zip . McAfee has also shared the virus sample with other anti-virus researchers, so that they too can develop solutions to protect their customers.

McAfee Anti-Virus Researchers Provide Rapid Response to Virus Outbreaks

According to market researcher IDC, McAfee's VirusScan is the world's most popular anti-virus software, selling more units that all other titles combined. As the world's leading vendor of anti-virus software, McAfee is considered the computer industry's Center for Disease Control.

AVERT researchers, which are located in the U.S., Japan, France and the Netherlands, work 24 hours a day to analyze approximately 1,000 suspect files submitted each month by McAfee customers. In order to provide rapid response to emerging virus threats, AVERT now posts hourly beta updates for detectors of new viruses on the Internet at beta.mcafee.com. McAfee is the industry's only anti-virus vendor to provide this level of protection.