The Melissa worm, also known as "Mailissa", "Simpsons", "Kwyjibo", or "Kwejeebo", is a mass-mailing macro virus, hence leading some to classify it as a computer worm.
|
Contents
- 1 History
- 2 Worm Specifications
- 2.1 Melissa.A/Original Version
- 2.2 Melissa.I/Empirical
- 2.3 Melissa.O
- 2.4 Melissa.U
- 2.5 Melissa.V
- 2.6 Melissa.W
- 2.7 Melissa.AO
- 3 See also
- 4 Sources/External Links
- 5 Notes and references
|
History
First found on March 26, 1999, Melissa shut down Internet mail systems that got clogged with infected e-mails propagating from the worm.
Melissa was first distributed in the Usenet discussion group alt.sex. The virus was inside a file called "List.DOC," which contained passwords that allow access into 80 pornographic websites. The worm's original form was sent via e-mail to many people.
Melissa was written by David L. Smith in Aberdeen Township, New Jersey, and named after a lap dancer he encountered in Florida. The creator of the virus called himself Kwyjibo, but was shown to be identical to macrovirus writers VicodinES and Alt-F11 who had several Word-files with the same characteristic Globally Unique Identifier (GUID), a serial number that was earlier generated with the network card MAC address as a component. Smith was sentenced to 10 years but served only 20 months in a federal prison and fined $5,000 United States dollars. [1]
Worm Specifications
Melissa can spread on word processor Microsoft Word 97 and Word 2000. It can mass-mail itself from e-mail client Microsoft Outlook 97 or Outlook 98. The worm does not work on any other versions of Word, including Word 95, nor can it mass-mail itself via any other e-mail client, even Outlook Express.
If a Word Document containing the virus, either LIST.DOC or another infected file, is downloaded and opened, then the macro in the document runs and attempts to mass mail itself.
When the macro mass-mails, it collects the first 50 entries from the alias list or address book, and sends it to the e-mail addresses of those names.
Melissa.A/Original Version
This is what infected e-mails say:
From: <name of the infected sender>
Subject: Important message from <name of sender>
To: <The recipients, from the 50 names>
Attachment: LIST.DOC
Body: Here is that document you asked for ... don't show anyone else ;-)
If the worm already has sent itself, or cannot spread that way for lack of an Internet connection or Outlook, it spreads to other Word Documents on the computer. Other infected documents can also be mailed. If confidential data is inside the document, the recipient of the e-mail containing the document can view it.
The worm's activation routine inserts quotes from the animated television program The Simpsons into other documents when the minutes of the hour of the computer's clock match the day of the month (e.g., 7:09 on the 9th day of the month). Quotes include phrases like "Twenty-two points, plus triple-word-score, plus fifty points for using all my letters. Game's over. I'm outta here." The alias of the author, "Kwyjibo", is also a Simpsons reference.
Melissa.I/Empirical
This variant can send using any of these subject line and body combinations, all of which differ from Melissa's original form.
- Subject: Question for you...
Body: It's fairly complicated so I've attached it.
- Subject: Check this!!
Body: This is some wicked stuff!
- Subject: Cool Web Sites
Body: Check out the Attached Document for a list of some of the best Sites on the Web
- Subject: 80mb Free Web Space!
Body: Check out the Attached Document for details on how to obtain the free space. It's cool, I've now got heaps of room.
- Subject: Cheap Software
Body: The attached document contains a list of web sites where you can obtain Cheap Software
- Subject: Cheap Hardware
Body: I've attached a list of web sites where you can obtain Cheap Hardware"
- Subject: Free Music
Body: Here is a list of places where you can obtain Free Music.
- Subject: * Free Downloads
Body: Here is a list of sites where you can obtain Free Downloads.
NOTE: The asterisk "*" in the 8th subject can be any random character that the worm specifies in the e-mail.
This version uses a different registry key, named "Empirical," to check if the worm had already mass mailed itself.
This version has another payload: if the number of minutes equals the number of hours, the worm inserts the phrase "All empires fall, you just have to know where to push." The virus then clears the flag indicating that it had mass-mailed itself from the registry. As soon as Word is restarted, a new document is created, a document is opened, or a document is closed, the worm will mass-mail itself again.
Melissa.O
This version sends itself to 100 people in the alias list instead of 50. This is the e-mail message it sends:
Subject: Duhalde Presidente
Body: Programa de gobierno 1999 - 2004.
Melissa.U
This version is similar to Melissa.A, with several notable differences. The module name it uses is named "Mmmmmmm". This version sends itself to only 4 recipients instead of 50. This is what the infected e-mail looks like:
Subject: Pictures (Username)
Body: what's up ?
The worm puts the name that the sender's copy of Word is registered to where it says Username in the Subject.
The following strings can be placed in documents: "Loading... No", and ">>>>Please check Outlook Inbox Mail<<<<<".
The virus also deletes critical files. Before deleting the files, it strips them of their archive, hidden, and read-only attributes.
- C:\Command.com
- C:\Io.sys
- C:\Ntdetect.com
- C:\Suhdlog.dat
- D:\Command.com
- D:\Io.sys
- D:\Suhdlog.dat
Melissa.V
This is another variant of the original Melissa macro virus, and is akin to Melissa.U. It uses Microsoft Outlook, and tries to send itself to the first 40 addresses in Outlook's address book. The subject line of the infected e-mail sent out is: "My Pictures (<Username>)", where <Username> is the name to whom the sender's copy of Microsoft Word is registered to.
There is no body to the email, but there is an infected document attached. If this is opened, the payload is triggered immediately. It tries to delete data from the following (local or network) destinations: F:, H:, I:, L:, M:, N:, O:, P:, Q:, S:, X:, and Z:.
Once complete, it beeps three times and then shows a message box with the text: "Hint: Get Norton 2000 not McAfee 4.02".
Melissa.W
This is the same as Melissa.A,
Melissa.AO
This is what the e-mails from this version contain:
Subject: Extremely URGENT: To All E-Mail User - <current date>
Attachment: Infected Active Document
Body: This announcement is for all E-MAIL user. Please take note
that our E-Mail Server will down and we recommended you to read
the document which attached with this E-Mail.
Melissa.AO's payload occurs at 10 a.m. on the 10th day of each month. The payload consists of the worm inserting the following string into the document: "Worm! Let's We Enjoy."
See also
- Timeline of notable computer viruses and worms
- List of computer viruses
- Morris worm
- SQL slammer worm
- Code Red worm
Sources/External Links
Notes and references
- ^ U.S. Department of Justice (2002-05-01). Creator of Melissa Computer Virus Sentenced to 20 Months in Federal Prison. Press release. Retrieved on 2006-08-30.
Categories: Macro viruses | E-mail worms
