Symantec United States
global sites
products
purchase
service and support
security updates
downloads
about symantec
search
feedback


©1995-2014 Symantec Corporation.
All rights reserved.

Legal Notices
Privacy Policy

security updates

W97M.Melissa.W

Category 2
Discovered on: January 17, 2001
Last Updated on: November 12, 2003 11:29:22 PM

Due to the recent decrease in infection activity of this worm the threat severity rating has been lowered from 4 to 2. Virus definitions dated prior to January 18, 2001, detect this worm as W97M.Melissa.Variant. Definitions dated January 18, 2001, or later detect this worm as W97M.Melissa.W, and will fully repair it.

W97M.Melissa.W is a Word 97 macro virus. It has a payload that emails itself using Microsoft Outlook. The subject of the email message is:

Important Message From <your name>

This worm is functionally identical to the original W97M.Melissa.A worm that was discovered in 1999.

Type: Virus, Worm

protection
  • Virus Definitions (Intelligent Updater)
  • January 18, 2001

    threat assessment

    Wild

    Threat Metrics

    Low Medium High

    Wild:
    Low

    Damage:
    Medium

    Distribution:
    High

    Damage

    Distribution

    technical details

    W97M.Melissa.W is a typical macro virus, which has an unusual payload. When you open an infected document, the virus attempts to email a copy of the document to up to 50 other people using Microsoft Outlook.

    The macro disables the Macro item on the Tools menu in Microsoft Word.

    It infects Microsoft Word 97 and Microsoft Word 2000 documents by adding a new VBA5 (macro) module named Melissa. Although there is nothing unique in the infection routine of this macro virus, it has a payload that uses Microsoft Outlook to send an attachment, which is the infected document that is being opened.

    As its primary payload, the virus attempts to use Microsoft Outlook to email a copy of the infected document to up to 50 other people. When you open or close an infected document, the virus first checks to see if it has already done this by checking the following registry key:

    HKEY_CURRENT_USER\Software\Microsoft\Office\

    for the value

    Melissa? ...by Kwyjibo

    • If this value exists, indicating that the mass emailing has been done previously from that computer, the virus does not attempt to do it again.
    • If this value does not exist, the virus does the following:
      1. It opens Microsoft Outlook.
      2. Using MAPI calls, the virus causes the user profile to use Microsoft Outlook.
      3. The virus creates a new email message to be sent to up to 50 addresses listed in your Microsoft Outlook address book.
      4. It gives the email message the subject line

        Important Message From <your user name>

        where <your user name> is taken from your Microsoft Word settings.
      5. The body of the email message is

        Here is that document you asked for ... don't show anyone else ;-)
      6. It attaches the active document (the infected document being opened or closed) to the email message.
      7. It sends the email message.

    NOTE: The registry key HKEY_CURRENT_USER\Software\Microsoft\Office\ is created by Microsoft Office. The virus simply adds the new value Melissa? to this registry key. This value is set to "...by Kwyjibo" if the virus has previously emailed an infected document from the system. Once the value is set, the virus does not attempt another mass mailing from the same computer.

    There is a second payload, which triggers once per hour, at the number of minutes past the hour corresponding to the date. For example, on the 16th of the month, the payload triggers at 16 minutes after every hour. If an infected document is opened or closed at the appropriate minute, this payload inserts the following sentence into the document:
      Twenty-two points, plus triple-word-score,
      plus fifty points for using all my letters.
      Game's over. I'm outta here.

    NOTE: W97M.Melissa.W can also infect other documents on your computer, even if Microsoft Outlook is not installed. It is, therefore, potentially possible for a new document from any user's computer to be emailed to other people if the following occur:
    1. You open Document 1 containing the W97M.Melissa.W infection.
    2. W97M.Melissa.W also infects a new Document 2 on the your computer (even if you do not have Microsoft Outlook).
    3. You email Document 2 to another person who has not previously been infected by W97M.Melissa.W and who does have Microsoft Outlook.
    4. When that second person opens the infected Document 2 on their computer, the document will be emailed to 50 people using Microsoft Outlook.

    Hiding its activity
    Similar to most macro viruses, this macro virus tries to hide its activity by disabling the following menu items:
    • Tools > Macro in Microsoft Word 97
      In Word 97, the virus disables the Macro command on the Tools menu. By disabling this menu command, the virus prevents you from displaying the macro / VBA module in Word 97 so that you can manually check for infection.
    • Macro > Security in Microsoft Word 2000
      In Word 2000, the virus disables the Security item on the Macro submenu. By disabling this menu command, the virus prevents you from changing the security level in Word 2000.

    To hide its infection activity, the virus also disables the following options in Word 97:
    • The Prompt to save the Normal.dot template
    • Confirm conversion when opening a document
    • Macro virus protection
    With these options disabled, Word 97 does not warn or prompt when saving the Normal.dot template or while opening a document containing macros.

    recommendations

    Symantec Security Response encourages all users and administrators to adhere to the following basic security "best practices":

    • Turn off and remove unneeded services. By default, many operating systems install auxiliary services that are not critical, such as an FTP server, telnet, and a Web server. These services are avenues of attack. If they are removed, blended threats have less avenues of attack and you have fewer services to maintain through patch updates.
    • If a blended threat exploits one or more network services, disable, or block access to, those services until a patch is applied.
    • Always keep your patch levels up-to-date, especially on computers that host public services and are accessible through the firewall, such as HTTP, FTP, mail, and DNS services (for example, all Windows-based computers should have the current Service Pack installed.). Additionally, please apply any security updates that are mentioned in this writeup, in trusted Security Bulletins, or on vendor Web sites.
    • Enforce a password policy. Complex passwords make it difficult to crack password files on compromised computers. This helps to prevent or limit damage when a computer is compromised.
    • Configure your email server to block or remove email that contains file attachments that are commonly used to spread viruses, such as .vbs, .bat, .exe, .pif and .scr files.
    • Isolate infected computers quickly to prevent further compromising your organization. Perform a forensic analysis and restore the computers using trusted media.
    • Train employees not to open attachments unless they are expecting them. Also, do not execute software that is downloaded from the Internet unless it has been scanned for viruses. Simply visiting a compromised Web site can cause infection if certain browser vulnerabilities are not patched.

    removal instructions

    Recent virus definitions dated prior to January 18, 2001 will detect this worm as W97M.Melissa.Variant, but will not repair it. Definitions dated January 18, 2001, or later detect this worm as W97M.Melissa.W and will fully repair it.

    To remove W97M.Melissa.W:

    1. Run LiveUpdate to make sure that you have the most recent virus definitions.
    2. Restart the computer in Safe Mode.
    3. Run a full system scan.
    4. If any files are found to be infected with W97M.Melissa.W, choose Repair.

    You can also obtain virus definitions by downloading them from:
    http://www.symantec.com/avcenter/download.html


    Write-up by: Patrick Martin