Sophos

WM97/Melissa-AB

Category
Type
What to do

Summary

 
Included in our products from April 2000 (3.32)
Detected by All Sophos products

More Information

WM97/Melissa-AB is based upon a number of different Word macro viruses, the main one being WM97/Melissa.

Upon closing an infected document the virus does the following:

In December, if the day of the month is greater than the 23rd, the virus displays a message box asking:

"I wish you a Merry X-mas!! Do you love me ?"

If you answer "Yes" the virus responds with

"Thank You! I Love You. You are so cute."

If you answer "No" the virus responds with:

"You are so rude."
"Fuck you, Asshole!"

The virus then forwards itself to the first 15 addresses in your mail address book:

Subject: An important advice from <username>

Message text: Take a look in this Document, urgent suggestions to be a cool man!! ;-)

The currently opened document is attached.

On January 1st the virus displays the message:

"Happy New Year!!"

On the 28th or 29th of February it displays the messsage:

"It's Kouki's Birthday!"

Also upon opening of an infected document the virus disables all the menus in Word. To recover from this payload delete your NORMAL.DOT global template.

RSS|Atom
Get reports about the latest virus and spyware threats delivered to your computer