W97M.Melissa.U (Gen1)

The "W97M.Melissa.U (Gen1)" virus is a modified variant of the infamous W97M.Melissa.A virus that wreaked havoc worldwide in late March 1999. In early October 1999, a variant was discovered called W97M.Melissa.U virus. Norton AntiVirus will detect W97M.Melissa.U with the current Melissa variant engine. It will be detected as either "W97M.Melissa.A" or "W97M.Melissa.Variant".

The W97M.Melissa.U (Gen1) virus is a modified version of the W97M.Melissa.U virus. These two viruses are not the same. For more details on W97M.Melissa.U, please refer to its separate write-up.

When initially analyzing W97M.Melissa.U (Gen1), it may appear to be a corrupted replicant of the W97M.Melissa.U virus. However, the corruption does not appear to be natural. The modification could have been intentional or it is possibly an incorrect repair performed by an antivirus product.

When W97M.Melissa.U (Gen1) infects other files, they will become infected with W97M.Melissa.U, rather than W97M.Melissa.U (Gen1). This is because the modified binary copy of the macro will not be copied. The problem is that W97M.Melissa.U (Gen1) has a worm component where it can email itself to other users. In such cases, it will email itself (W97M.Melissa.U (Gen1)) rather than its replicant (W97M.Melissa.U). This is an extremely important note because in order to be protected from this virus, you will need protection for both W97M.Melissa.U and W97M.Melissa.U (Gen1). Symantec AntiVirus Research Center has done an analysis with various popular antivirus software, and discovered W97M.Melissa.U (Gen1) will not be detected. However, Norton AntiVirus and most other antivirus software were able to detect W97M.Melissa.U. Besides having the modification/corruption described above, the behavior of the virus is identical to W97M.Melissa.U.

Protection

• Initial Rapid Release version October 15, 1999
• Latest Rapid Release version October 15, 1999
• Initial Daily Certified version October 15, 1999
• Latest Daily Certified version October 15, 1999
• Initial Weekly Certified release date pending

Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

Threat Assessment

Wild

• Wild Level: Low
• Number of Infections: 0 - 49
• Number of Sites: 0 - 2
• Geographical Distribution: Low
• Threat Containment: Easy
• Removal: Easy

Damage

• Damage Level: Medium

Distribution

• Distribution Level: Medium