The Melissa Word Macro Virus

What is the Melissa Word macro virus?

The Melissa Word macro virus, also known as Mailissa, affects machines with Word97 or Word2000. It was first reported on Friday 26 March 1999. The virus is spread through e-mail. Typically, a person receives an e-mail message with the following subject line:

Subject: Important Message From <some name>

The message text is:

"Here is that document you asked for ... don't show anyone else ;-)".

The message contains, as an attachment, a Word file which might (or might not) be named list.doc or list.zip. If the recipient opens the Word file and does not have Word macro virus checking turned on, the macro is executed and his or her system is infected. The normal.dot template is infected and all files opened in Word from that point on will also be infected. If Microsoft Outlook is present on the machine (regardless of whether or not Outlook was used to read the message), the virus reads the first 50 entries in the MAPI Address Book and sends e-mail to those addresses, again with the subject "Important Message From <your name>", including an infected Word file as an attachment

Receiving and reading the e-mail is not sufficient to become infected, you must open the Word attachment to become infected. If Outlook is not present on your system, the 50 e-mail messages described above will not be sent; however, once your system is infected, any Word attachments you send will carry the virus and will infect the recipients if they open the attachments.

You can protect yourself by deleting any mail you receive with a subject line "Important Message From <some name>", not opening the attached Word file. You should also make sure that your copy of Word is set not to execute Word macros. You can do this by opening Word, going to Tools>Options... and, under the "General" tab, making sure that the box "Macro virus protection" is checked, then clicking "OK". More details are available in the CERT Advisory on the Melissa Word macro virus, which includes a number of useful links to other sites.

How can I remove the Melissa Word macro virus?

Symantec's Web site gives information on how Norton AntiVirus owners can download the latest update to protect against and remove the virus.

If you are affiliated with Boston University, you can download and install the latest version of Network Associates' McAfee VirusScan for free, as Boston University has a site license for this product. Please visit BU's anti-virus software Web site for more information. This site will prompt you for your BU login name and password before allowing access. Note that this program checks for, but does not remove, the Melissa Word macro virus and the happy99 Trojan program.

I received e-mail saying that a message I sent to someone at Boston University could not be delivered because my message might contain the Melissa Word macro virus. What should I do?

It appears that your system may be infected. As described above, the Melissa Word macro virus has probably used Outlook on your system to send infected e-mail to the first 50 addresses in your MAPI address book. If you send any Word attachments, those attachments will be infected and could spread the virus to the recipients. To avoid sending this virus on to new recipients, you should not send any further e-mail until you remove the Melissa Word macro virus from your computer.

Return to main virus information page