Melissa Microsoft Word Virus

Note: This document dates from March 1999. It was my response to concerns about the Melissa Microsoft Word Macro Virus.

Summary

There are many email virus hoaxes. There are some real email viruses travelling in Word (and Excel) documents. At the end of March 1999, a Word email virus called "Melissa" is circulating. It's not too bad, but it does email itself and your documents to people you know. More details below.

Hoaxes and real email viruses

Normally, I warn people that email viruses are not really a problem, and that there are a lot of fake warning messages floating around.

(e.g. see http://www.europe.datafellows.com/news/hoax.htm )

There is currently (30/3/99) a real email virus which is spreading quite fast. It doesn't really interfere with your machine too much, but it does send email copies of itself to people in your address book. As with all these kind of viruses, it will only be activated when you read a Word document. It's a "Word Macro Virus".

The Melissa Virus

Melissa travels in emails with the title "Important Message From [name of infected user]" - though it is easy for someone to change this to something else. To quote from "Data Fellows"...

http://www.europe.datafellows.com/news/pr/eng/19990327.htm "...Most recipients are likely to open such a file, as it usually comes from someone they know.

After sending itself out, the virus continues to infect other Word documents. Eventually, these files can end up being mailed to other users as well. This can be potentially disastrous, as a user might inadvertently send out confidential data to outsiders.

The virus activates if it is executed when the minutes of the hour match the day of the month - for example 18:27 on the 27th day of a month. At this time the virus will insert the following phrase into the current document which the user has open in Word: "Twenty-two points, plus triple-word-score, plus fifty points for using all my letters. Game's over. I'm outta here". This text, as well as the alias name of the virus author, "Kwyjibo", are references to the popular "Simpsons" cartoon TV series. "

What to do

How to avoid this email message becoming a highly circulated warning:

1. Don't forward it after 25/4/99.
2. Always circulate it in full - i.e. containing this date and hoax page info.

How to avoid this and future macro viruses:

1. Be careful when reading Word document files - if you're not sure about what they are, you can always ask the person who mailed them to you.
2. Virus check your email - Datafellows (for example) have trial software to download.

Where to look

My Email Viruses And Chain Letters page at

General Virus stuff:

• http://www.europe.datafellows.com/
• http://www.av.ibm.com/
• http://www.sarc.com/

Melissa Specific:

• http://www.cert.org/tech_tips/Melissa_FAQ.html - Melissa FAQ
• http://www.symantec.com/avcenter/venc/data/mailissa.html
• http://www.europe.datafellows.com/news/pr/eng/19990327.htm<;
• http://www.zdnet.com/zdnn/special/melissavirus.html
• http://www.ciac.org/ciac/bulletins/j-037.shtml

Virus Hoaxes:

• http://www.symantec.com/avcenter/hoax.html
• http://www.europe.datafellows.com/news/hoax.htm
• http://ciac.llnl.gov/ciac/CIACHoaxes.html
• http://www.kumite.com/myths/
• http://www.av.ibm.com/current/Feature2/
• http://www.ciac.org/ciac/CIACHoaxes.html

-- Andy Pryke - 16 Jul 2001