WM97/Melissa-AM

WM97/Melissa-AM is a variant of the well-known Melissa Word macro virus.

If you have more than 10 addresses in any of your Outlook address books the virus forwards itself via email to between 30-60 percent of the addresses. It randomly sets the importance level of the email to Low, Medium or High.

The subject line used by the virus in the email message it forwards is created randomly from a series of phrases to construct a sentence:

"Hello!", "Hi!",
"Here", "I think this", "Gee...Guess this"
"is", "used to be", "are"
"that", "the", "your"
"file", "document", ".doc"
"you requested", "they asked"

In this way subject lines used by the virus when it forwards itself could include:

"Hello! I think this used to be your document you requested"

or

"Hi! Gee...Guess this are the file they asked"

Attached to the email will be an infected Word document. If the recipient opens the document in Microsoft Word they will be infected by the virus.

WM97/Melissa-AM also sends system information, such as your user name, time zone and registered user details to several fixed email addresses: infx@iname.com, fafx@fastermail.com and apfx@apexmail.com.

The virus author presumably programmed the virus to do this in order to keep a record of everybody who was infected.