Resume(aka Melissa) - RESUME1.DOC (BG)

tasklist.org		A comprehensive list of processes running in your computer
		tasklist \| attachlist

bookmark this website!		total tasks: 16297

AttachList is a list of email attachment files that viruses usually send in email. It contains the attached file names, typical subjects and messages, the name of the viruses that send them, and instruction on how to remove these viruses.

most requested

Browse attachlist by file name:

| a | b | c | d | e | f | g | h | i | j | k | l | m | n | o | p | q | r | s | t | u | v | w | x | y | z |

Name: Resume

Sender:

Varies.

Subject:

Begins with the words "Important Message From ...(USERNAME)" (gen)
(where USERNAME is the name registered in the local copy of Word)
Elecciones 2000: ultima encuesta Apoyo!" or "Urgente: Confirmar (AU)
My pictures USERNAME (V)
pictures USERNAME (U)
Resume - Janet Simons (BG)
(see above) (M)

Message:

Here is that document you asked for ... don't show anyone else ;-)"
(gen)

Attachment:

Explorer.doc (BG)
NORMAL.DOT (BG)
RESUME1.DOC (BG)

Comments: A Word 97 macro virus

Symptoms:


 If "HKEY_CURRENT_USERSoftwareMicrosoftOffice" as "Melissa?" is set
to value "...by Kwyjibo", it is a sign of infection. 
 There is a second payload which triggers once an hour, at the number
of minutes past the hour corresponding to the date (i.e., on the 16th
of the month, the payload triggers at 16 minutes after every hour). If
an infected document is opened or closed at the appropriate minute,
this payload will insert the following sentence into the document: 
 " Twenty-two points, plus triple-word-score, plus fifty points for
using all my letters. Game's over. I'm outta here." 
 Can email sensitive documents (AM)

Recommended Cleanup Software: We found that Easy SpyRemover is the most effective tool for removing this file.

Manual Removal Instructions: Run LiveUpdate to make sure that you have the most recent virus definitions.
Start Norton AntiVirus (NAV), and make sure that NAV is configured to scan all files.
Run a full system scan.
If any files are detected as infected by W97M.Melissa.A , click Repair.