http://vil.mcafee.com/vil/vm10120.asp VIRUS PROFILE McAfee Online : Support : Virus Information Library Virus Name W97/Melissa Date Added 3/26/99 Virus Characteristics This virus checks for a setting in the registry to test if the system has already been infected. This virus checks for low security in Office2000 by checking the value from the registry; while the value HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Word\Security\"Level" is not null, disable "MACRO/SECURITY" menu option. Otherwise Word97 menu option "TOOLS/MACRO" is disabled. This virus creates an Outlook object using Visual Basic instructions and reads the list of members from the address book. An email message is created and sent to the list of first 50 recipients created with the subject "Important Message From " Application.UserName, with a body text of "Here is that document you asked for ... don't show anyone else ;-)". The active infected document is attached and the email is sent. The document text contains a list of pornographic web sites. This virus creates an entry in the registry- HKEY_CURRENT_USER\Software\Microsoft\Office\ "Melissa?" = "... by Kwyjibo" Comments inside the macro virus include 'WORD/Melissa written by Kwyjibo 'Works in both Word 2000 and Word 97 'Worm? Macro Virus? Word 97 Virus? Word 2000 Virus? You Decide! 'Word -> Email | Word 97 <--> Word 2000 ... it's a new age!
