A new virus was discovered on 3/26/99.  It is called Melissa (or W97M_Melissa) and could be quite a headache (or nightmare) if your computer is infected.  Keep in mind that this virus doesn't actually cause any damage (as far as we know) but could be rather troublesome for yourself and people you email regularly.   Runestone Internet has already taken steps to prevent you from getting this virus, read below for a description.

Here are the details:

What is required:

The virus will only affect computers which have Microsoft Word 97 or 2000 (included in Microsoft Office 97 and Office 2000)  installed.   The virus will cause the most trouble if you use Microsoft Outlook as your email program, or frequently share Microsoft Word files with other people (computers.)

How you get Melissa:

You would receive an email message with the subject "Important message from [name]."  The name would likely be the owner of the computer and also someone you know. When the message is read the text would contain, "Here's the important document you asked for. Don't show anyone else - ;-)" There would also be an attachment, "links.doc." The virus infects your computer when you open the attached file.

Remember that the person you received the message from probably doesn't even know they are infected.

What Melissa does:

Melissa is a "Word macro" virus, meaning it infects the Microsoft Word program and Word documents. If you open the "links.doc" file, the Word template file (normal.dot) on the will be infected.  The virus will then infect any existing Word file when you open it, and any new Word documents will also be infected.

Every time an infected file is opened, the Melissa virus automatically sends itself to the first 50 people in your Outlook Contacts list (at this point, we have no evidence that this happens if you use Outlook Express.) Basically, everyone in your address book will get a copy of the virus every time you open an infected file. That message would look the same as the one detailed above.

Also, if you open a document when the minute of the hour (e.g., the "29" of 8:29 AM) matches the day of the month (today is the 29th) the following would be inserted into the document: "Twenty-two points, plus triple-word-score, plus fifty points for using all my letters. Game's over. I'm outta here."

What we can do:

We have already updated our system to restrict the receipt or delivery of these messages.

If you are currently or become infected, and Melissa tries to send out the messages, your email program will give you an error stating:

"The message could not be sent because an e-mail address was rejected by the server. Subject 'Important message from you', Account: 'runestone.net', Server: 'runestone.net', Protocol: SMTP, Server Response: '553 This message may contain the Melissa virus.', Port: 25, Secure(SSL): No, Server Error: 553, Error Number: 0x800CCC6E"

Basically, this is saying that the message being sent out may be Melissa trying to send itself and we (Runestone Internet) don't want you to send it to anyone else. The messages would quickly accumulate in the "Outbox" of your mail program, but wouldn't actually be spread to anyone else.

If a computer from outside Runestone Internet tries to send in a Melissa type email, they will receive a similar message, so the message will never reach you.  These protections are system wide and should help to keep any trouble to a minimum.   However, they were not in place until late Saturday, so you may have received the virus between Friday afternoon and Sunday morning.

If you use a virus program, we recommed you update the virus definition files. Anti-virus software makers Norton and McAfee came out with updates within hours of discovering the virus. Updating the definition files will allow the virus program to catch the Melissa virus before it infects your computer and will also warn you that you have received it.

How to get rid of it:

With the latest virus definitions, both Norton AntiVirus and McAfee VirusScan will detect and remove the Melissa virus.

We are still searching for a method of manually removing the virus.

Please contact us if you have further questions.

Return to the Announcements page.

This document was last updated on  Thursday, January 22, 2004, at 07:12 PM