On Thursday, January 18th, the diligent folks at MessageLabs issued a report indicating that a new variant of Melissa was making it's mark on their ThreatList. Indeed, as of Friday morning, January 19th, antivirus vendors had issued alerts warning that dozens of customers were reporting infection and that the variant might be on its way to widespread infection.

Apparently, this new variant, dubbed Melissa.W by some vendors and Melissa.X by others, is successfully bypassing some antivirus software. According to F-Secure, "it's not really a new version of the virus; the format of the infected file has changed. The file Anniv.doc is in Microsoft Word 2001 for Macintosh format. This is problematic, as several antivirus programs are still unable to handle this new file format, but the file and the virus is fully functional under both Macintosh and Windows versions of Microsoft Office." (F-Secure is able to detect this format).

According to Mikko Hypponen, Manager of Anti-Virus research at F-Secure, "The worst effects of this worm are the same as for other Melissa versions, usually: overloading e-mail servers with huge traffic and sometimes e-mailing confidential Word documents to a wide audience".

Because the Melissa virus is sent from an infected users' machine, others are likely to open the email simply because it is from someone they know. The virus began spreading with the attachment name "ANNIV.DOC", though that attachment name could easily change.

Melissa.W infects Windows 95, 98, Me, NT, 2000 and Macintosh users and spreads from any machine using Microsoft Outlook.

Previous Articles