Newsgroups reflect virus' scope, speed
Patrick Nolan, who identified himself as an employee of a leading virus hunting software firm, described on alt.comp.virus how he first heard of Melissa on Friday morning.
"Got in to work this morning and about 10am the phone started ringing off the hook... After checking for inquiries, located a slough of submissions for this new macro virus, the first at about 8am from Norway. The messages were coming in from all over the globe -- Australia, Germany, Italy, U.K. -- I could tell that it was going to be one of those days."
Killer: Group addresses
The reason it was going to be one of those days, he said, was because of the way that Melissa was working its way through company email systems: The virus propagates via e-mail as a Word attachment, which launches a macro that replicates a message to the first 50 names in any Microsoft Outlook/Exchange address book. In the corporate world those addresses can be groups -- one address that can go to hundreds, even thousands, of recipients.
"Take a look at your typical corporate global address book -- the email-groups are sorted to the top, meaning that the virus would grab entries such as 'Sales-North-America' or other group names. By 11am (PDT) I had seen enough to know that this wasn't just a fluke of a virus and that this was going to be real trouble."
Other people posted descriptions of damage. "This has brought our servers down affecting 10,000 users. Very sad to see," wrote Jay Dee, on microsoft.public.exchange.admin.
Newsgroup contributors also began some amateur sleuthing, in an attempt to finger Melissa's author. One noted that its creator called himself as "kwyjibo." Under some cicrumstances, the virus also makes reference to "The Simpsons" animated sitcom.
Who's 'kwyjibo?'
"Out of all of this I decided to look for aliases related to kwyjibo on the internet. Somebody by that name posts heavily on Simpsons newsgroups... It is possible that this is not this person, though... the Simpsons television series included an episode about Scrabble in which Bart Simpson played the bogus word KWYJIBO defining it as a 'balding North American ape with a small chin'. To which Marge Simpson added 'and a short temper.'
Elsewhere on the Internet, anti-virus companies were quick to post descriptions of Melissa, as well as remedies. Also posted on some sites were copies of the actual code -- a benefit to the virus community investigating how the technology works, but also a blueprint for hackers-in-training.