|
Name
W97M/Melissa.o
Aliases
Unknown
Variants
None
Date Added
11/16/99
Information
| | Discovery Date: | 11/11/99 |
| | Type: | Virus |
| | SubType: | Macro |
| | Risk Assessment: | Medium |
| | Minimum DAT: | 4054 |
Characteristics
This is a virus for Word 97 documents. It is able to replicate under the SR-1 release of Word 97. It will turn off the macro warning feature of Word 97. This virus consists of a module called "x". It is a copy-cat of the W97M/Melissa.a virus in that there is a payload to send the infected file via MS Outlook.
This virus hooks the system event of closing documents Word97 by the subroutine "Document_Close" (in the global template) thereby running its code. Infected documents contain the subroutine "Document_Open" which also is a system event.
The Outlook email routine which is designed to create an email message with the first 100 recipients with the subject of the message is "Duhalde Presidente " (Office97 User Name) and the body of the message is "Programa de gobierno 1999 - 2004."
Symptoms
Macro warning if opening infected document, increase in size to global template. Email propagation as mentioned above.
Method Of Infection
Opening infected documents will infect global template normal.dot.
EXTRA Drivers
VirusScan 4 with the 4.0.25 engine (and above) download here
Dr. Solomon's AVTK 7.99 and above download here
Removal Instructions
Not Available...
| 
