Threat Encyclopedia

Selected viruses, spyware, and other threats: sorted alphabetically

W97M/Melissa.A

This is a macro virus intended for Word from the family Office 97 and Office 2000. After the document is read in Office 97 the virus turns off warnings on presence of macros, on conversion and on storing the template. In case of Office 2000 it blocks access to setting the safety in the menu Tools/Macro a turns off protection on running macros. After that the virus checks whether the computer has already been infected. It finds it out by existence of specific key in registers. If Melissa had been activated in the computer it created the key "Melissa?" in HKEY_CURRENT_USER\Software\Microsoft\Office\ and set it to the value "… by Kwyjibo". Melissa is relatively simple common virus. The virus was made famous and got a lot of attention because of that what follows. The virus finds out whether there is the application Microsoft Outlook in the system. If it is, the virus gradually opens lists of e-mail addresses and prepares a report for each of them. It takes the first 50 addresses from each of the lists as addressees. Then it sets the subject. To the string "Important Message From " it adds the name of the Word user. The text of the message itself is formed by the string "Here is that document you asked for … don't show anyone else ;-)". Melissa sends this message and of course it does not forget to attach the infected document to it. At the end of the virus is the following text:

WORD/Melissa written by Kwyjibo
Works in both Word 2000 an Word 97
Worm? Macro Virus? Word 97 Virus? Word 2000 Virus? You Decide!
Word -> Email | Word 97 <--> Word 2000 … it's a new age!
If the ordinal number of the current day in the month equals the current number of minutes, Melissa writes:
Twenty-two points, plus triple-word-score, plus fifty points for using all my letters. Game's over. I'm outta here.

The author of the virus seems to be a fan of the animated series The Simpsons. Kwyjibo is the key word from the contest in spelling in which Bart Simpson took part in one of the episodes. From there also the abovementioned quotation comes from.

© 1992-2004 Eset s.r.o. All rights reserved. No part of this Encyclopedia may be reproduced, transmitted or used in any other way in any form or by any means without the prior permission.