After January 17th, 2001, F-Secure started receiving reports about a
new version of Melissa, this time spreading in a file called
This version was named Melissa.W. It's not really a new version of the
virus; the format of the infected file has changed. The file Anniv.doc
is in Microsoft Word 2001 for Macintosh format. This is problematic,
as several antivirus programs are still unable to handle this new file
format, but the file and the virus is fully functional under both
Macintosh and Windows versions of Microsoft Office.
By January 19th, we had received dozens of infection reports from various
parts of the world, with the rate of infections increasing. It seems
that this virus might become very widespread rapidly.
The only functional difference between Melissa.A and Melissa.W is that
the W variant does not lower the macro security settings in Word 2000.
For full details on the Melissa virus, see the description of
Melissa.A at http://www.F-Secure.com/v-descs/melissa.shtml
The worm sends e-mail to addresses found from Microsoft Outlook
The e-mails look like this:
From: (name of infected user)
Subject: Important Message From (name of infected user)
To: (50 names from address book)
Here is that document you asked for ... don't show anyone else ;-)
Attachment: Anniv.doc (the infected active document)
Do notice that Melissa.W can arrive in any document - the attachment
does not necessarily have to be named Anniv.doc. The infected
attachments might also contain confidential data from the infected
E-mail worms such as Melissa spread effectively, as users are likely
to open a e-mails coming from someone they know.
You don't need to have Microsoft Outlook to receive the virus in
e-mail. However, the virus will not spread further from your machine
via e-mail unless you have Outlook installed.
Melissa will not work under Word 95 and will not spread further under
Outlook Express. It can infect Windows 95, 98, Me, NT, 2000 and
F-Secure Anti-Virus is capable of detecting Melissa.W even though it
spreads inside a Word 2001 for Macintosh document.
Download your updates from here:
[Analysis: Katrin Tocheva, Mikko Hypponen and Sami Rautiainen, F-Secure]