Word97Macro/Melissa

was discovered on the end of March 1999. It has the ability to spread via e-mail and to do this very quickly. It is able to infect many computers amazingly fast in the environment of Outlook and Exchange users.

Recognition

In most cases, W97/Melissa infiltrates a user system as the attachment to an e-mail with the subject "Important Message From [Application.UserName]." The body of the message contains the text "Here is that document you asked for ... don't show anyone else ;-)''.

When such attachment is opened, W97/Melissa checks for the following entry in the registry: HKEY_CURRENT_USER/Software/Microsoft/Office/``Melissa?'' and if such entry is not found,  Melissa reads the list of recipiens from Outlook Global Address Book. An email message with the same subject and text is created and sent to the first 50 recipients from the list. It then sets the entry mentioned above to the value "... by Kwyjibo".

Melissa also disables the MACRO/SECURITY approval screen and resets the document security to none. It also contains the following payload: if the day equals the minute value the following text is inserted at the current cursor position: "Twenty-two points, plus triple-word-score, plus fifty points for using all my letters. Game's over. I'm outta here.".