Melissa is Back

Espoo, Finland - January 19, 2001

F-Secure Corporation (HEX:FSC), a world leading provider of centrally-managed, widely distributed security solutions, is warning computer users about an e-mail worm which is currently spreading globally.

Melissa.W is a version of one of the most widespread viruses in history, Melissa.A. The original Melissa spread around the world as an e-mail chain letter in March 1999.

After January 17th, 2001, F-Secure started receiving reports about a new version of Melissa, this time spreading in a file called Anniv.doc. By January 19th, F-Secure had received dozens of infection reports from various parts of the world, with the rate of infections increasing. It seems that this virus might become very widespread rapidly.

This version was named Melissa.W. It's not really a new version of the virus; the format of the infected file has changed. The file Anniv.doc is in Microsoft Word 2001 for Macintosh format. This is problematic, as several antivirus programs are still unable to handle this new file format, but the file and the virus is fully functional under both Macintosh and Windows versions of Microsoft Office.

The only functional difference between Melissa.A and Melissa.W is that the W variant does not lower the macro security settings in Word 2000 The worm sends itself as an e-mail attachment to addresses found from Microsoft Outlook address book.

Melissa.W can arrive in any document - the attachment does not necessarily have to be named Anniv.doc. The infected attachments might also contain confidential data from the infected computers.

"There's nothing really new here", says Mikko Hypponen, Manager of Anti-Virus research at F-Secure. "But the change in Microsoft file formats does make this particular version of Melissa somewhat troublesome."

"The worst effects of this worm are the same as for Melissa versions usually: overloading e-mail servers with huge traffic and sometimes e-mailing confidential Word documents to a wide audience", he continues. E-mail worms such as Melissa spread effectively, as users are likely to open e-mails coming from someone they know. You don't need to have Microsoft Outlook to receive the virus in e-mail. However, the virus will not spread further from your machine via e-mail unless you have Outlook installed. Melissa will not work under Word 95 and will not spread further under Outlook Express. It can infect Windows 95, 98, Me, NT, 2000 and Macintosh users. F-Secure Anti-Virus is capable of detecting Melissa.W even though it spreads inside a Word 2001 for Macintosh document.