OFF98: How the Melissa and Papa Macro Viruses Affect Mac Office 98 (226540)

SUMMARY

On Friday March 26th, 1999, Microsoft received a report of a Microsoft Word macro virus, "Melissa" that affects Microsoft Word for Windows users. On Monday, March 29th, 1999, a new variant of the Melissa virus was reported. This article contains information on this new variant, "Papa", and describes the steps you can take to ensure that both the Papa and the Melissa viruses do not cause problems on your computer. As is common with viruses, additional variants will likely emerge; however, in the case of any of these variants, the recommended protective precautions are also effective. By taking the necessary precautions, you can ensure these macro virsuses do not affect your computer.

The macro functionality of Microsoft Office programs provides a programming environment that allows customers and developers to extend the functionality of Office. Malicious hackers have taken advantage of this macro functionality to create harmful viruses. As with all virus issues, Microsoft takes this issue very seriously. Because of the widespread nature of this particular virus, Microsoft is taking steps to proactively notify our customers to help minimize its impact. Microsoft is actively working with the anti-virus community and other Internet security groups to educate customers on the situation and to help minimize the impact of this class of virus.

MORE INFORMATION

Who Can These Viruses Affect?

This virus can affect people using Microsoft Word 98 Macintosh Edition, or Microsoft Excel 98 Macintosh Edition. If you do not use these programs, this particular virus does not affect you.

If you have installed and run system-emulation programs like Connectix Virtual PC, or Insignia Solution's RealPC and SoftWindows, in combination with Office 97, or Office 2000, and Outlook 98 or 2000, the Melissa and Papa virus will behave exactly as it does in Windows. For more information about how these viruses can affect you, visit:

http://office.microsoft.com/en-us/assistance/HA010450611033.aspx .

What Is the Melissa Macro Virus?

The Melissa macro virus is a Word 98 macro virus delivered via e-mail in an attached Word document. The e-mail contains the subject line

Important Message From UserName

and contains the message body:

Here is that document you asked for ... don't show anyone else ;-).

If the attached Word document is opened and the macro is allowed to run, the virus will infect your computer. The macro virus is copied to the Normal template (Normal.dot), and every document subsequently created in Word contains the virus. Unlike Word for Windows 97 or 2000, this virus will not propagate itself (the virus sends mail to the first 50 people in your e-mail client address book). Word will not automatically send e-mail from Outlook Express Macintosh Edition, or Outlook for Macintosh, Exchange Server Edition. Although Word 98 Macintosh Edition will not inadvertently send the virus in e-mail, once infected with the virus a user can infect others. By opening a Word document from an infected computer, whether sent through e-mail or simply saved on a file server, additional computers can be infected.

The name of the original infected Word document is "List", but this could be changed to any name. This virus does not appear to destroy data. If the current day of the month equals the minute value of the current time, and the infected document is opened, the following text is inserted at the insertion point:

Twenty-two points, plus triple-word-score, plus fifty points for using all my letters. Game's over. I'm outta here.

What Is the Papa Macro Virus?

The Papa virus is a Microsoft Excel 98 macro virus delivered via e-mail in an attached Excel document and is a variant of the Melissa virus. In the case of the Papa virus, the e-mail contains the subject line

Fwd: Workbook from all.net and Fred Cohen

and may contains the message body:

Urgent info inside. Disregard macro warning.

If the attached Excel document named "Pass" is opened, and the macro is allowed to run, the virus will infect the user's computer. The virus will not be able to propagate itself by sending e-mail with the infected document from Outlook Express Macintosh Edition, or Outlook for Macintosh, Exchange Server Edition.

Although the name of the attached, infected Excel document is Pass, both this and the subject line could be changed to any name. The Papa virus does not appear to destroy data.

Will Office 98 Protect Me from This and Other Macro Viruses?

Yes. Office programs including Word and Excel are designed to protect you from macro viruses including the Melissa and Papa viruses. The macro virus protection in these programs will detect these and any variants. Macros protection is turned on by default. With macro virus protection turned on, every time you open a document that contains macros, a message appears and asks you to choose whether to enable or disable the included macros. You should always disable macros when you are not certain of their purpose or function. By choosing to disable macros, you will prevent any macro viruses from running and prevent infection by the virus. The virus is only activated if you open the attached document and choose to enable the macros, or if your macro virus protection has been previously turned off and you open the attachment.

Even if the message containing the virus is not opened, it could still infect others if it is forwarded. To minimize risk from this virus and to prevent spreading the virus further, if you receive e-mail with the above-mentioned attachment or subject line, delete it immediately without opening the message.

To Turn On Office Macro Virus Protection

On the Tools menu, click Preferences.
On the General tab, click to select Macro Virus Protection and click OK.

IMPORTANT: If you are not able to follow the steps above because you cannot find the menu items, you may already be infected. If so, run anti-virus software containing the latest update, and scan your system often. Support for this particular virus is already available from a number of anti-virus companies; for a list of vendors, see the KB article cited later in this article. If you are not able to run anti-virus software, it will be necessary to delete or rename your Normal.dot template file. Once you delete this file, start Word to automatically recreate the template file. After this is done, repeat the steps above to turn on macro virus protection.

What Should I Do If I Think I Have Been Infected?

Run anti-virus software containing the latest update and scan your system often. Support for this particular virus is already available from anti-virus companies. For additional information about the sorts of anti-virus programs available, click the article number below to view the article in the Microsoft Knowledge Base:

49500 List of Antivirus Software Vendors