Description:

W97M/Melissa.U [a variant of the W97M/Melissa.A virus] is spread as an e-mail attachment via MAPI and the Microsoft Outlook address book. The virus copies itself to e-mail address book entries. It has a destructive payload and has been reported in the wild.

W97M/Melissa.U appears as an e-mail attachment in a message with the following text:

Subject: "pictures" [sender username]

Messsage Body: "what's up ?"

">>>>>please check outlook inbox mail<<<<<"

The virus will attempt to delete the following system files in the root directories of the C: and D: drives of an infected machine:

\COMMAND.COM
\IO.SYS
\NTDETECT.COM
\SUHDLOG.DAT

Command AntiVirus deffiles dated 10/12/99 offer specific detection and disinfection for this virus. Command AntiVirus detects W97M/Melissa.U with heuristic scanning as a suspicious file. If you have on-access protection enabled, you will be prevented from opening the attachment and will not become infected.