W97M.Melissa.A

W97M.Melissa.A is a Word 97 macro virus that has a payload to email itself using MS Outlook. The subject of the e-mail is "Important Message From USERNAME".

Also Known As:	W97M.Mailissa
Type:	Macro
Infection Length:	One macro module
Systems Affected:	Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows XP
Systems Not Affected:	DOS, Linux, Macintosh, OS/2, UNIX, Windows 3.x

Virus Definitions (LiveUpdate™ Weekly) April 09, 1999 Virus Definitions (Intelligent Updater) April 09, 1999

Wild Number of infections: More than 1000 Number of sites: More than 10 Geographical distribution: Low Threat containment: Easy Removal: Easy

Threat Metrics Wild: Low Damage: Medium Distribution: High

Damage

• Payload Trigger: Opening or closing of an infected document
• Payload:
  • Modifies files: Modifies MS Word settings and infects documents and templates
  • Degrades performance: May crash e-mail server
  • Releases confidential info: Could e-mail sensitive documents

Distribution

• Subject of email: "Important Message From USERNAME"
• Name of attachment: ·Document's name
• Size of attachment: One document

W97M.Melissa.A (also known as W97M.Mailissa) is a typical macro virus which has an unusual payload. When a user opens an infected document, the virus will attempt to e-mail a copy of this document to up to 50 other people, using Microsoft Outlook.

Similar to W97M.Pri, the virus turns off the security protection upon opening an infected document in MS Word 2000. This disables MS Word 2000 macro prompt the next time the document is opened.

It infects a MS Word 97 and MS Word 2000 document by adding a new VBA5 (macro) module named Melissa. Although there is nothing unique in the infection routine of this macro virus, it has a payload that utilizes MS Outlook to send an attachment of the infected document being opened.

As its primary payload, the virus will attempt to use Microsoft Outlook to e-mail a copy of the infected document to up to 50 other people. When a user opens or closes an infected document, the virus first checks to see if it has done this mass e-mailing once before, by checking the following registry key:

"HKEY_CURRENT_USER\Software\Microsoft\Office\" as "Melissa?" value.

If this key has a value "Melissa?" set to the value "...by Kwyjibo", then the mass e-mailing has been done previously from the current machine. The virus will not attempt to do the mass mailing a second time, if it has already been done from this machine.

If it does not find the registry entry, the virus does the following:

1. Open MS Outlook.
2. Using MAPI calls, it gets the user profile to use MS Outlook.
3. It creates a new e-mail message to be sent to up to 50 addresses listed in the user's MS Outlook address book.
4. It gives the email message a subject line:

"Important Message From USERNAME",

where USERNAME is taken from MS Word setting.

"Here is that document you asked for ... don't show anyone else ;-)"

Please note that "HKEY_CURRENT_USER\Software\Microsoft\Office" is a registry entry created by MS Office. The virus simply adds the new value "Melissa?" into this registry entry. This value is set to "…by Kwyjibo" if the virus has previously e-mailed an infected document from the system. Once the value is set, the virus will not attempt another mass mailing from the same machine.

There is a second payload which triggers once an hour, at the number of minutes past the hour corresponding to the date (i.e., on the 16th of the month, the payload triggers at 16 minutes after every hour). If an infected document is opened or closed at the appropriate minute, this payload will insert the following sentence into the document:

" Twenty-two points, plus triple-word-score,

plus fifty points for using all my letters.

Game's over. I'm outta here."

1. User opens Document 1 containing W97M.Melissa.A infection.
2. W97M.Melissa.A also infects a new Document 2 on the user's machine (even if the user does not have MS Outlook).
3. User e-mails Document 2 to another person who has not previously been infected by W97M.Melissa.A and who does have MS Outlook.
4. When that second person opens the infected Document 2 on their machine, the document will be e-mailed to 50 people via MS Outlook.

Hiding its activity

Similar to most macro viruses, this macro virus tries to hide its activity by disabling the following menu items:

· Tools-Macro in MS Word 97

By disabling this menu command, the virus prevents any user from listing the macro / VBA module in MS Word 97 to manually check for infection.

By disabling this menu command, it prevents the user from changing the security level in MS Word 2000.

· Prompt to save Normal template
· Confirm conversion at Open
· Macro virus protection

With these options disabled, MS Word 97 does not warn or prompt while saving the NORMAL.DOT or while opening a document with macros in it.

Symantec Security Response encourages all users and administrators to adhere to the following basic security "best practices":

• Turn off and remove unneeded services. By default, many operating systems install auxiliary services that are not critical, such as an FTP server, telnet, and a Web server. These services are avenues of attack. If they are removed, blended threats have less avenues of attack and you have fewer services to maintain through patch updates.
• If a blended threat exploits one or more network services, disable, or block access to, those services until a patch is applied.
• Always keep your patch levels up-to-date, especially on computers that host public services and are accessible through the firewall, such as HTTP, FTP, mail, and DNS services (for example, all Windows-based computers should have the current Service Pack installed.). Additionally, please apply any security updates that are mentioned in this writeup, in trusted Security Bulletins, or on vendor Web sites.
• Enforce a password policy. Complex passwords make it difficult to crack password files on compromised computers. This helps to prevent or limit damage when a computer is compromised.
• Configure your email server to block or remove email that contains file attachments that are commonly used to spread viruses, such as .vbs, .bat, .exe, .pif and .scr files.
• Isolate infected computers quickly to prevent further compromising your organization. Perform a forensic analysis and restore the computers using trusted media.
• Train employees not to open attachments unless they are expecting them. Also, do not execute software that is downloaded from the Internet unless it has been scanned for viruses. Simply visiting a compromised Web site can cause infection if certain browser vulnerabilities are not patched.

1. Run LiveUpdate to make sure that you have the most recent virus definitions.
2. Start Norton AntiVirus (NAV), and make sure that NAV is configured to scan all files. For instructions on how to do this, read the document How to configure Norton AntiVirus to scan all files.
3. Run a full system scan.
4. If any files are detected as infected by W97M.Melissa.A , click Repair.

Write-up by: Raul K. Elnitiarta