A | B | C | D | E | F | G | H | I | J | K | L | M | N | O | P | Q | R | S | T | U | V | W | X | Y | Z | Encyclopedia Home
Also see: Hoax Encyclopedia | Repair Center | News Briefs | Glossary | Infected Attachments | Prevention Center
|
Melissa
Type: Word97 Macro virus and mass-mailing email worm
According to F-Secure, Melissa has the following characteristics:
Description:
W97M/Melissa was initially distributed in an internet discussion group called alt.sex. The virus was sent in a file called LIST.DOC, which contained passwords for X-rated websites. When users downloaded the file and opened it in Microsoft Word, a macro inside the document executed and e-mailed the LIST.DOC file to 50 people listed in the user's e-mail alias file ("address book").
The e-mail looked like this:
From: (name of infected user)
Subject: Important Message From (name of infected user)
To: (50 names from alias list)
Here is that document you asked for ... don't show anyone else ;-)
Attachment: LIST.DOC
F-Secure warns users that Melissa can arrive in any document, not necessarily just in this LIST.DOC where it was spread initially. According to MessageLabs, at least one variant (Melissa.W) travels with the attachment name "ANNIV.DOC".
After sending itself out, the virus continues to infect other Word documents. Eventually, these files can end up being mailed to other users as well. This can be potentially disastrous, as a user might inadvertently send out confidential data to outsiders.
The virus activates if it is executed when the minutes of the hour match the day of the month; for example, 18:27 on the 27th day of a month. At this time the virus will insert the following phrase into the current open document in Word: "Twenty-two points, plus triple-word-score, plus fifty points for using all my letters. Game's over. I'm outta here". This text, as well as the alias name of the author of the virus, "Kwyjibo", are all references to the popular cartoon TV series called "The Simpsons".
W97M/Melissa works with Microsoft Word 97, Microsoft Word 2000 and Microsoft Outlook 97 or 98 e-mail client. You don't need to have Microsoft Outlook to receive the virus in e-mail, but it will not spread itself further without it.
Melissa will not work under Word 95. Melissa will not spread further under Outlook Express.
Melissa can infect Windows 95, 98, NT and Macintosh users. If the infected machine does not have Outlook or internet access at all, the virus will continue to spread locally within the user's own documents.
What to look for: There are many variants of the Melissa virus. For complete details on all the variants, see F-Secure's description.
Aliases:
Simpsons, Kwyjibo, Kwejeebo, Mailissa
Systems Affected: Windows 95, 98, NT and Macintosh users. If the infected machine does not have Outlook or internet access at all, the virus will continue to spread locally within the user's own documents.
Payload: Mass-mailing can result in crippled email systems. Can send out confidential information from infected user's computer. If the virus is executed when the minutes of the hour match the day of the month, the virus will insert the following phrase into the current open document in Word: "Twenty-two points, plus triple-word-score, plus fifty points for using all my letters. Game's over. I'm outta here".
ITW: Yes
Origin:
How to prevent it: Do not open attachments received unexpectedly, even from known sources. Keep your antivirus software up-to-date, save and scan any attachments before opening.
