The "W97M.Melissa.U (Gen1)" virus is a modified variant of the infamous W97M.Melissa.A virus that wreaked havoc worldwide in late March 1999. In early October 1999, a variant was discovered called W97M.Melissa.U virus.

It will be detected as either "W97M.Melissa.A" or "W97M.Melissa.Variant".

The W97M.Melissa.U (Gen1) virus is a modified version of the W97M.Melissa.U virus. These two viruses are not the same.

When initially analyzing W97M.Melissa.U (Gen1), it may appear to be a corrupted replicant of the W97M.Melissa.U virus. However, the corruption does not appear to be natural. The modification could have been intentional or it is possibly an incorrect repair performed by an antivirus product.

When W97M.Melissa.U (Gen1) infects other files, they will become infected with W97M.Melissa.U, rather than W97M.Melissa.U (Gen1). This is because the modified binary copy of the macro will not be copied. The problem is that W97M.Melissa.U (Gen1) has a worm component where it can email itself to other users. In such cases, it will email itself (W97M.Melissa.U (Gen1)) rather than its replicant (W97M.Melissa.U). This is an extremely important note because in order to be protected from this virus, you will need protection for both W97M.Melissa.U and W97M.Melissa.U (Gen1).

Symantec AntiVirus Research Center has done an analysis with various popular antivirus software, and discovered W97M.Melissa.U (Gen1) will not be detected. However, Norton AntiVirus and most
other antivirus software were able to detect W97M.Melissa.U. Besides having the modification/corruption described above, the
behavior of the virus is identical to W97M.Melissa.U.

Characteristics of Infection

The document infected with W97M.Melissa.U (Gen1) will arrive in an email with the following Subject line and body with a Word document attachment:

Subject: pictures USERNAME
Body:  whats up?

USERNAME will be the name registered in the local copy of Word. For example, it may be "Subject: pictures John Doe".
If you receive such an email, Do not attempt to open the attached document.

There are three payloads.

As its primary payload, the virus will attempt to use Microsoft Outlook to e-mail a copy of the infected document to up to four email addresses.
The email addresses are selected from Outlook's address book. Please note that a mailing-list (a list comprising more than one email address) within Outlook Address Book can be selected by the virus, which will then cause a larger distribution of email to be spammed. Corporations using Microsoft Exchange are the primary target of W97M.Melissa.U(Gen1) because the virus searches for Outlook's Address Book. This payload will only be executed once on each machine.

The second payload will insert the following text into the active document:

>>>>>Please Check Outlook Inbox Mail<<<<<

If you see such text in any of your documents, please be certain to scan your system using the latest virus definitions.

The third payload will delete the following files when the infected file is opened (making the system un-bootable):

c:\command.com
c:\io.sys
d:\command.com
d:\io.sys
c:\Ntdetect.com
c:\Suhdlog.dat
c:\Ntdetect.com
d:\Suhdlog.dat

All users are encouraged to confirm that macro virus protection is set to High in Word 2000, and enabled in Word 97.