| WM.Melissa |
| Short description |
This
virus, initially posted as a list of password to pornographic sites, comes
under the form of an attached Word document called list.doc (in its initial
variant - new documents will probably be infected in the future). When opened
in Word, a macro will execute and e-mail up to 50 recipients with the following
message From: (name of infected user) Subject: Important Message From (name of infected user) To: (50 names from alias list) Here is that document you asked for ... don't show anyone else ;-) Attachment: LIST.DOCThe virus activates if it is executed when the minutes of the hour match the day of the month - for example 18:27 on the 27th day of a month. It will insert the sentence "Twenty-two points, plus triple-word-score, plus fifty points for using all my letters. Game's over. I'm outta here"... Microsoft Word 97, Microsoft Word 2000 and Microsoft Outlook are the virus' main targets. Users of other e-mail packages are relatively safe, although special care must of course be taken since the virus can spread normally and infect a Word or Outlook user later. (27/03/99) |
| In practice |
| Do not open list.doc, regardless of the fact that it appears to have been sent by a friend, password protect your normal.dot ! As a sidenote, it should ne noted that this virus was previously detected by F-PROT heuristics. |
|
This
virus seems to be a very fast spreader, probably because many people will
open attachments without any question if they appear to have been sent
by friends or at least regular correspondents
|
DataRescue 45 quai de la Dérivation 4020 Liège (Belgium) tel 32-4-3446510 fax 32-4-3446514 Please send us your questions or comments. |