Melissa virus. It infects Word documents and e-mails itself to other users.
Summary
[ hide ]
- 1 Features
- 1 Operation
- 2 Remarks on Melissa
- 1 Blocking mail servers
- 3 Melissa Mutations
- 1 Decontamination
- 4 Sources
characteristics
The virus spreads itself via email automatically from one user to another. When the virus is activated, it modifies the user’s documents and inserts comments from the TV series “The Simpsons” . And what is worse, it can send confidential information from the computer without the user noticing.
Functioning
The Melissa virus infects Word files by taking advantage of its ability to run Visual Basic Scripts. Its main actions are the following:
- It infects MS Word and it infects all files that are opened.
- Change certain settings to facilitate infection.
- It is auto-mailed, as a message from the user to the first 50 mailboxes of the address book of his mail.
When an infected Word document is opened, Melissa infects the normal.dot document template, which is where all the program’s default settings and macros are located. From this moment all the files will be infected by the virus.
It was initially distributed in an Internet discussion group called alt.sex. The virus was sent in a file called LIST.DOC, which contained passwords for X-classified websites. When the user downloaded the file and opened it with Microsoft Word, a macro was executed on the document that sent the LIST.DOC file to 50 people listed in the user’s email address book.
The message was:
- From: (name of the infected user)
- Subject: Important Message From (name of infected user)
- To: (50 names from the phonebook)
- Here is that document you asked for … don´t show anyone else ;.)
- Attachement: LIST.DOC
Most recipients agree to open the file since it comes from someone they know. After sending the document, the virus continues to infect other Word documents accessed by the user. Fortuitously, these documents can end up being sent to other users, being potentially disastrous since the user can inadvertently send confidential information to outsiders.
The virus is activated when the minute of the hours coincides with the day of the month – for example at 16:27 on the 27th. Then, the virus will insert the following sentence into the open document: “Twenty-two points, plus triple -word-score, plus fifty points for using all my letters. Game’s over. I’m outta here “ .
This text and the alias of the virus author (“Kwyjibo”) refer to the cartoon series “The Simpsons” . W97M / Melissa works with Microsoft Word 97, Microsoft Word 2000 and Microsoft Outlook. It can infect both Windows and Macintosh users. If the infected computer does not have Outlook or Internet access, the virus will continue to spread locally to the documents that the user accesses.
Comments on Melissa
There is some confusion regarding the Melissa virus. The virus does not send pornographic pages or documents. The mention of this issue is due to the fact that this virus originated in a newsgroup (alt.sex) where a message with an attached Word document appeared, in which a list of passwords to pornographic sites was offered.
This document (infected with the “Melissa” virus), was quickly downloaded by almost all users (perhaps hundreds or thousands), who were the first to be infected. Without knowing it, they sent each of the first 50 users of their own address books 50 new infected documents (documents from their own computer, all of them personal).
The “Melissa” does not cause damage to the affected computers. The only modification of the registry is to be able to carry out its action only once (a way of hiding, unlike the “Pope” who does it every time we connect to the Internet), and the insertion of a text to the open document if it is they give certain conditions.
Mail server blocking
There has also been talk of the closure of mail servers, and other “setbacks” referred to by the media. This is true, and is due to the volume of messages generated by this infection.
A damage similar to but much higher than that produced by any letter type “chain” (those that ask us to send 5 or 10 acquaintances the same message to earn money, or participate in some solidarity task). It is easy to imagine it if we understand the concept of a person sending 50 messages to 50 other people, each of whom sends 50 to another 50 … And so on ad infinitum (and also each with attachments, with what! that it is not only the quantity but the size that reaches unsuspected limits!). If you take a calculator, you will see the impressive figures that this can reach.
The press has handled the issue with a certain sensationalism. We have seen TV news programs that never mentioned the topic of viruses, that have issued alerts as if it were a nuclear war. The danger exists, it is true – we must not minimize it – but let us remember that the main cause of their spreading is our own behavior. We must never open or execute anything that we have not requested. And we must always review any program, document or any other type of file, before opening or executing it, with at least two updated antivirus.
Melissa mutations
- Names:
- Word97.Melissa.b
- Excel97.Papa.a
- Excel97.Papa.b
Melissa.b is a variant of Melissa, but it only has its worm part active.
In your code, the global macro area and all infection routines are commented out (the code exists, but is commented out with the VisualBasic “this is a comment” character , leaving it inactive). In the comment field of the author of the document, it reads: We don’t want to actually infect the PC , just warn them. The infected document is attached to an e-mail message with the following information: Subject: Trust No One
Decontamination
Antivirus like:
- Nod32
- Kaspersky
- Panda
