| W97M/Melissa.A Virus |
W97M/Melissa.A is a macro virus that is currently in the wild (reported March 26, 1999). It infects Word 97 and Word 2000 documents. It is spread via the Microsoft Outlook e-mail address book. For a detailed press release on the subject, please click here.
Download The Definition File Now for Detection and Disinfection of W97M/Melissa.A
Behavior
W97M disables macro virus protection and creates the following registry entry:
HKEY_CURRENT_USER\Software\Microsoft\Office\Melissa="... by Kwyjibo"
The virus creates an Outlook object and reads the Outlook address book. The virus adds itself to the created object as an attachment and is sent to up to 50 recipients.
The subject of the message is reads:
"Important Message From [name of the user who got infected]"
The body of the message reads:
"Here is that document you asked for ... don't show anyone else ;-)"
If the current day of the month is equal to the current time (3/26; 3:26) and the user is using Word, a message is inserted into the document:
" Twenty-two points, plus triple-word-score, plus fifty points for using all my letters. Game's over. I'm outta here."
The following comments are in the virus body
'WORD/Melissa written by Kwyjibo
'Works in both Word 2000 and Word 97
'Worm? Macro Virus? Word 97 Virus? Word 2000 Virus? You Decide!
'Word -> Email | Word 97 <--> Word 2000 ... it's a new age!
The virus infects DOC files when closing the document. It infects template documents when the document is opened.
Users are cautioned not to open e-mail with the subject line and body text detailed above. Infection is indicated by the presence of the word "Kwyjibo" in the registry.
| Virus Databases | Virus Links | ||
| Virus Research | Security |
Test Drives |
Year 2000 |
Site Map |
Customer Service |
Press Room |
Awards/ Reviews |
Global Resellers |
 |
Command Software Systems, Inc. 1061 East Indiantown Road · Suite 500 Jupiter · FL 33477 Phone: (561) 575-3200 |