Melissa.A
Threat LevelDamageDistribution

Effects 

Melissa.A has the following effects:

• It goes memory resident.
• It disables the Word antivirus protection for documents with macros.
  
  As a result, Word does not ask the user’s confirmation to enable or disable macros included in documents, when these are opened.

• It prevents users from working with macros, both in Word 97 and Word 2000.
  
  In Word 97, it disables the Macro option in the Tools menu.
  In Word 200, it disables the Macro option in the Tools menu.
• It sends itself out to the first fifty addresses found in the Outlook Address Book.

• It infects Word 97 and Word 2000 documents as well as global template.

Infection strategy 

Melissa.A inserts the following entry in the Windows Registry:

• HKEY_CURRENT_USER\ Software\ Microsoft\ Office\ "Melissa?"  "... by Kwyjibo"
  
  In this way, Melissa.A knows it has infected the computer. If it reaches the computer again, Melissa.A will look for the above entry and on finding it, it will know the system is already infected. Hence, the virus avoids reinfecting computers.

Melissa.A looks for the following entry in the Windows Registry:

• HKEY_CURRENT_USER\ Software\ Microsoft\ Office\ 9.0\ Word\ Security\ Level
  
  If the value assigned to the entry is not Null, Melissa.A disables the options that allow users to work with Word macros (Tools - Macro in Word 97 and Tools - Macro – Security in Word 2000).

In order to carry out infections, the virus inserts the Melissa module in every Word 97 and Word 97 document and template. This macro module is written in the Visual Basic 5 programmimg language.

Means of transmission 

Melissa.A spreads via e-mail in the following way:

• It opens the Outlook mail program when an infected document is opened.
• It captures and uses the infected user profile, through calls to MAPI.
• It creates an e-mail message with the following characteristics:
  
  Subject:
  Important Message From "sender’s name"
  
  Message:
  Here is that document you asked for ... don't show anyone else ;-)
  
  Attachments: a file with a DOC extension.
  
  The recipients of this message are the first fifty addresses that Melissa.A finds in the Outlook Address Book.

Further Details  

Melissa.A was originally distributed through an Internet newsgroup called alt.sex.

The virus code has the following text:

'WORD/Melissa written by Kwyjibo
'Works in both Word 2000 and Word 97
'Worm? Macro Virus? Word 97 Virus? Word 2000 Virus? You Decide!
'Word -> Email | Word 97 <--> Word 2000 ... it's a new age!