Virus Encyclopedia
Welcome to the Virus Encyclopedia of Panda Security.
Melissa.A | |
Threat Level Damage Distribution |
Effects
Melissa.A has the following effects:
It prevents users from working with macros, both in Word 97 and Word 2000.
In Word 97, it disables the Macro option in the Tools menu.
In Word 200, it disables the Macro option in the Tools menu.
It sends itself out to the first fifty addresses found in the Outlook Address Book.
Infection strategy
Melissa.A inserts the following entry in the Windows Registry:
HKEY_CURRENT_USER\ Software\ Microsoft\ Office\ "Melissa?" "... by Kwyjibo"
In this way, Melissa.A knows it has infected the computer. If it reaches the computer again, Melissa.A will look for the above entry and on finding it, it will know the system is already infected. Hence, the virus avoids reinfecting computers.
Melissa.A looks for the following entry in the Windows Registry:
In order to carry out infections, the virus inserts the Melissa module in every Word 97 and Word 97 document and template. This macro module is written in the Visual Basic 5 programmimg language.
Means of transmission
Melissa.A spreads via e-mail in the following way:
- It opens the Outlook mail program when an infected document is opened.
- It captures and uses the infected user profile, through calls to MAPI.
- It creates an e-mail message with the following characteristics:
Subject:
Important Message From "sender’s name"
Message:
Here is that document you asked for ... don't show anyone else ;-)
Attachments: a file with a DOC extension.
The recipients of this message are the first fifty addresses that Melissa.A finds in the Outlook Address Book.
Further Details
Melissa.A was originally distributed through an Internet newsgroup called alt.sex.
The virus code has the following text:
'WORD/Melissa written by Kwyjibo
'Works in both Word 2000 and Word 97
'Worm? Macro Virus? Word 97 Virus? Word 2000 Virus? You Decide!
'Word -> Email | Word 97 <--> Word 2000 ... it's a new age!