The Happy.exe virus is a fairly old virus now but this is a brand new virus that was apparently released late last week and none of the anti virus companies (Symantec or Mcafee) have had time to do an update of the virus signatures yet. This is for real, and can be verified by going to ZD net or CNET's site. BE Careful with this one.
Dave
The new "Melissa" virus infects Microsoft
Word documents using Visual Basic for
Applications -- the built-in scripting language in
the Microsoft Office suite. The virus has three
main actions:
1.It infects Word and spreads to all Word
documents you open.
2.It changes some settings to ease
infection.
3.It e-mails itself using Microsoft Outlook,
masquerading as a message from you.
When you open an infected Word document,
Melissa spreads to your NORMAL.DOT
document template. This is where Word stores
your custom settings and default macros. By
copying itself into NORMAL.DOT, Melissa
ensures that your Word installation is infected
and any documents or templates you create
will get the virus added.
The virus adds a new registry entry:
HKEY_CURRENT_USER Software Microsoft Office Melissa?
And give is the value: "... by Kwyjibo". If you
have this registry key, then that machine has
been infected by Melissa at some stage.
Melissa checks which version of Word you
have installed. It acts differently depending on
whether you are running Word 97 or the
forthcoming Word 2000. Melissa does not
infect Word 95 or earlier versions.
If you have Word 97...
After an infected document is opened in Word
97, the virus takes these actions:
1. It grays out and blocks access to the
"Macro" command in the Tools menu. This
effectively stops you from checking any macro
that may be present in a document or
template.
2. Melissa changes some Word 97 settings,
making it easier for the virus to spread itself.
Specifically, the "Macro virus protection,"
"Prompt to save Normal template," and
"Confirm Conversion at Open" options are
disabled.
Melissa checks which version of Word you
have installed. It acts differently depending on
whether you are running Word 97 or the
forthcoming Word 2000. Melissa does not
infect Word 95 or earlier versions.
If you have Word 97...
After an infected document is opened in Word
97, the virus takes these actions:
1. It grays out and blocks access to the
"Macro" command in the Tools menu. This
effectively stops you from checking any macro
that may be present in a document or
template.
2. Melissa changes some Word 97 settings,
making it easier for the virus to spread itself.
Specifically, the "Macro virus protection,"
"Prompt to save Normal template," and
"Confirm Conversion at Open" options are
disabled.
If you have Word 2000...
In the upcoming version of Microsoft's word processor, the virus acts slightly
differently:
1. Melissa grays out and blocks access to the Security settings command in the Tools | Macro menu. This effectively stops you from raising your macro-virus security to a level which prevents macros from running.
2. It also sets Word to the lowest macro-virus security level, so there's zero protection from unsafe macros.
How it spreads using Outlook
If you have the full version of Microsoft Outlook
installed (rather than Outlook Express), the
virus grabs up to 50 e-mail addresses from
your address book and sends them all a
message with an infected Word document
attached. The message appears to come from
you, and even uses your name in the heading.
For example:
FROM: <your e-mail name and address>
TO: <50 contacts from each address book
you have in Outlook>
SUBJECT: Important Message From <your
name, taken from Word's settings>
BODY: Here is that document you asked
for ... don't show anyone else ;-)
ATTACHMENT: <an infected document>
This method of distribution happens just the
first time the macro is run on a computer.
Most people only have a single address book
in Outlook (the Contacts folder), but if you
have more than one, then the Melissa virus will
grab up to 50 contacts from each of them.
What does the Melissa virus do?
The Bart Simpson joke
On top of all the the other actions, the virus
plays a simple prank if the hour and minute it's
run match the numeric month and day -- for
example if the macro is run at 12:29 in the
afternoon on the 29th of December. When the
time and date line up, Melissa types this
quote from Bart Simpson into your active
document: "Twenty-two points, plus
triple-word-score, plus fifty points for using all
my letters. Game's over. I'm outta here."
