Virus Name
W97/Melissa

Date Added
3/26/99

Virus Characteristics

This virus checks for a setting in the registry to test if the system has already been infected. This virus checks for low security in Office2000 by checking the value from the registry; while the value HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Word\Security\"Level" is not null, disable "MACRO/SECURITY" menu option. Otherwise Word97 menu option "TOOLS/MACRO" is disabled.  

This virus creates an Outlook object using Visual Basic instructions and reads the list of members from the address book. An email message is created and sent to the list of first 50 recipients created with the subject "Important Message From " Application.UserName, with a body text of "Here is that document you asked for ... don't show anyone else ;-)". The active infected document is attached and the email is sent. The document text contains a list of pornographic web sites.  

This virus creates an entry in the registry-
HKEY_CURRENT_USER\Software\Microsoft\Office\
"Melissa?" = "... by Kwyjibo"

  Comments inside the macro virus include  

'WORD/Melissa written by Kwyjibo
'Works in both Word 2000 and Word 97
'Worm? Macro Virus? Word 97 Virus? Word 2000 Virus? You Decide!
'Word -> Email | Word 97 <--> Word 2000 ... it's a new age!

Indications Of Infection
Not Available...

Method Of Infection
Not Available...

Removal
http://vil.mcafee.com/vil/0402.asp

Virus Information

Variants
Unknown

Aliases
Unknown