Lumension® Endpoint Intelligence Center

Intelligence Center » Browse All Threats » W97M/Melissa.O

Overview

Threat Risk NONE NONE
Destructivity LOW LOW
Payload
Detection files published 16 Nov 1999 03:00:00
Description created 16 Nov 1999 03:00:00
Description updated 16 Nov 1999 03:00:00
Malware type VIRUS
Alias
Spreading mechanism EMAIL
FILE_INFECTION
Summary None

W97M/Melissa.O

Spreading

The W97M/Melissa.O virus will start to disable certain settings. If Melissa detects that Office2000 is in use, it will disable the Macro-Security menu item, otherwise, it assumes Office97 and will disable the Tools | Macro menu item.W97M/Melissa.O will then check for the existence of the registry entry HKEY_CURRENT_USER\Software\Microsoft\Office\"x?" = "y ".If this entry does not exist, the virus will start Outlook and mail an e-mail message to the first 100 entries of the global address book.After the e-mail session, Melissa will set the above-mentioned key in the registry preventing the virus to send out another series of infected documents. The infected document that will be e-mailed to the first 100 entries of the global address book is the first W97M/Melissa.O infected document that is loaded on the system.

Payload Details

If a document is opened, and the value of the day number +1 equals the value of the minute + 2, Melissa will insert a space (blank) in the body of the document's text at the place of the cursor position.

Analysis

n/a

Removal

n/a


Last Updated: 12 Nov 2015 11:06:14