YOU’RE NOT VIEWING PANDA SECURITY USA. CLICK TO IMPROVE YOUR EXPERIENCE
VISIT PANDA SECURITY USA
x
48h OFFER
If you're already a customer of
our homeusers protection,
renew now with 50% off
RENEW NOW
x
48-HOUR OFFER
50%
RENEWALS
Home users only
RENEW AT A DISCOUNT
x
SPECIAL OFFER
If you're already a customer of
our homeusers protection,
renew now with 50% off
RENEW NOW
x
HALLOWEEN OFFER
take advantage of our
terrific discounts
BUY NOW AND GET 50% OFF
x
SPECIAL OFFER
Buy the best antivirus
at the best price
BUY NOW AND GET 50% OFF
x
SPECIAL OFFER
Buy the best antivirus
at the best price
BUY NOW AND GET 50% OFF
x
UP TO
-60%
BUY NOW
x
UP TO
-60%
BUY NOW
Active Scan. Scan your PC free

Virus Encyclopedia

Welcome to the Virus Encyclopedia of Panda Security.

Melissa.A

Threat LevelModerate threatDamageHighDistributionNot widespread

Effects 

Melissa.A has the following effects:

  • It goes memory resident.
  • It disables the Word antivirus protection for documents with macros.

    As a result, Word does not ask the user’s confirmation to enable or disable macros included in documents, when these are opened.
  • It prevents users from working with macros, both in Word 97 and Word 2000.

    In Word 97, it disables the Macro option in the Tools menu.
    In Word 200, it disables the Macro option in the Tools menu.
  • It sends itself out to the first fifty addresses found in the Outlook Address Book.
  • It infects Word 97 and Word 2000 documents as well as global template.

Infection strategy 

Melissa.A inserts the following entry in the Windows Registry:

  • HKEY_CURRENT_USER\ Software\ Microsoft\ Office\ "Melissa?"  "... by Kwyjibo"

    In this way, Melissa.A knows it has infected the computer. If it reaches the computer again, Melissa.A will look for the above entry and on finding it, it will know the system is already infected. Hence, the virus avoids reinfecting computers.

Melissa.A looks for the following entry in the Windows Registry:

  • HKEY_CURRENT_USER\ Software\ Microsoft\ Office\ 9.0\ Word\ Security\ Level

    If the value assigned to the entry is not Null, Melissa.A disables the options that allow users to work with Word macros (Tools - Macro in Word 97 and Tools - Macro Security in Word 2000).

In order to carry out infections, the virus inserts the Melissa module in every Word 97 and Word 97 document and template. This macro module is written in the Visual Basic 5 programmimg language.

Means of transmission 

Melissa.A spreads via e-mail in the following way:

  • It opens the Outlook mail program when an infected document is opened.
  • It captures and uses the infected user profile, through calls to MAPI.
  • It creates an e-mail message with the following characteristics:

    Subject:
    Important Message From "sender’s name"

    Message:
    Here is that document you asked for ... don't show anyone else ;-)

    Attachments: a file with a DOC extension.

    The recipients of this message are the first fifty addresses that Melissa.A finds in the Outlook Address Book.

Further Details  

Melissa.A was originally distributed through an Internet newsgroup called alt.sex.

The virus code has the following text:

'WORD/Melissa written by Kwyjibo
'Works in both Word 2000 and Word 97
'Worm? Macro Virus? Word 97 Virus? Word 2000 Virus? You Decide!
'Word -> Email | Word 97 <--> Word 2000 ... it's a new age!

ARE YOU FACING ANY PC OR INTERNET RELATED PROBLEMS?
FREE SUPPORT INCLUDED. CALL US 24/7

powered by Anytech365