Melissa.U Virus Variant Detected

Archived content. No warranty is made as to technical accuracy. Content may contain URLs that were valid when originally published, but now link to sites or pages that no longer exist.

Date: October 15, 1999
Severity: A (Severe)
Type of threat: Virus/Worm
Operating system: All Windows

This destructive variant of the Melissa.U virus attempts to delete several critical system files rendering an infected computer unusable. It also attempts to automatically replicate to the first four available recipients in the infected user's address book. Most current anti-virus software products DO NOT detect this variant at this time.

Summary

Microsoft has discovered a new variant of the Melissa.U virus which is not detected by most anti-virus software products at this time. Email messages with the infected Word document attachment will arrive with the subject line "pictures" followed by the registered name used for the local installation of Word that the email was sent from. Infection occurs when a user opens the infected Word document and chooses to "Enable Macros" or already has macro security set to Low (Word 2000) or disabled (Word 97) in which case the macro is run automatically.

It is important to note that the default Word 2000 macro security setting is "High" which silently disables unsigned macros like this Melissa.U variant. By default Word 97 always prompts the user before enabling potentially dangerous macros.

Details

Please see the following references for more information related to this issue:

Recommendation

Microsoft recommends that you take the following precautions:

  • Immediate delete any email message with the subject line beginning with "pictures"

  • Ensure that Word 2000 macro security setting is "High" or Word 97 Macro Virus Protection is enabled

  • Always "Disable Macros" if given a choice

  • Don't make yourself vulnerable to this or other viruses by opening an attachment unless you know what it is and who it is coming from

Disclaimer

This document is for information purposes only. This virus alert pertains only to the virus identified herein and there can be no guarantee that there won't be other viruses present. Microsoft provides this document "AS-IS", and hereby disclaims all warranties and conditions, either express, implied or statutory, including, but not limited to, any (if any) implied warranties, duties or conditions of merchantability, or fitness for a particular purpose.