OASIS Mailing List ArchivesView the OASIS mailing list archive below
or browse/search using MarkMail.


Help: OASIS Mailing Lists Help | MarkMail Help



   What McAfee says about new Word Macro virus (I've received it twice toda

[ Lists Home | Date Index | Thread Index ]
  • From: "Jeff Greif" <jmg@trivida.com>
  • To: <xml-dev@ic.ac.uk>
  • Date: Fri, 26 Mar 1999 15:52:26 -0800

McAfee Online : Support : Virus Information Library

Virus Name

Date Added

Virus Characteristics

This virus checks for a setting in the registry to test if the system has already been infected. This virus checks for low security in Office2000 by checking the value from the registry; while the value HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Word\Security\"Level" is not null, disable "MACRO/SECURITY" menu option. Otherwise Word97 menu option "TOOLS/MACRO" is disabled.  

This virus creates an Outlook object using Visual Basic instructions and reads the list of members from the address book. An email message is created and sent to the list of first 50 recipients created with the subject "Important Message From " Application.UserName, with a body text of "Here is that document you asked for ... don't show anyone else ;-)". The active infected document is attached and the email is sent. The document text contains a list of pornographic web sites.  

This virus creates an entry in the registry-
"Melissa?" = "... by Kwyjibo"

  Comments inside the macro virus include  

'WORD/Melissa written by Kwyjibo
'Works in both Word 2000 and Word 97
'Worm? Macro Virus? Word 97 Virus? Word 2000 Virus? You Decide!
'Word -> Email | Word 97 <--> Word 2000 ... it's a new age!

Send This Virus Information To A Friend?

Indications Of Infection
Not Available...

Method Of Infection
Not Available...

How To Clean Your System With VirusScan

Virus Information
  Discovery Date: 3/26/99
  Type: Macro



GIF image


News | XML in Industry | Calendar | XML Registry
Marketplace | Resources | MyXML.org | Sponsors | Privacy Statement

Copyright 2001 XML.org. This site is hosted by OASIS