The Melissa virus was a mass-mailing macro virus from March 1999. It was one of the more notorious computer viruses of the 1990s, and reportedly the author named it for a dancer he met in a Florida nightclub. Authorities quickly identified the author, David Lee Smith, and arrested him in New Jersey on April 1, 1999. He served two and a half years in prison and paid $7,500 in fines for creating the virus.
Melissa started by taking over Microsoft Word running on its victims’ computers. It then used a macro to hijack their Microsoft Outlook e-mail client and send messages to the first 50 addresses in their Outlook address book. Those messages, in turn, tempted recipients with a virus-laden attachment under names as “sexxxy.jpg” or “naked wife” or the deceitful assertion, “Here is the document you requested … don’t show anyone else ;-).” This devious social engineering let the virus operate like a sinister, automated chain letter.
David Lee Smith, then aged 30, released the virus on Friday March 26, 1999. Smith used a hijacked AOL account to post the virus onto an Internet newsgroup called “alt.sex.” The owner of the account was a 37-year-old civil engineer from Lynnwood, Wash. named Scott Steinmetz. He described himself as barely computer literate. Steinmetz’ inbox filled with angry replies and he quickly found out he was a suspect. He turned himself in for questioning and the FBI rapidly cleared him. Ironically, Steinmetz’s own work e-mail account received a copy of the virus as Melissa spread to corporate networks.
Clues in the code led authorities to the rightful author. The code resembled code written by a virus writer who used the alias VicodinES. A virus toolkit on Vicodin’s website contained code with names embedded in it. One of the names that appeared three times in the toolkit was David L. Smith.
Both Smith and VicodinES used the same ISP in New Jersey, and VicodinES operated a web server physically located in Orlando. New Jersey authorities who examined the web server determined that Smith and VicodinES were not the same person , and that Smith borrowed code extensively from VicodinES, but Smith coded the part of the virus that did the damage.
The “list.doc” file contains a Visual Basic script that copies the infected file into a template file used by Word for custom settings and default macros. If the recipient opens the attachment, the virus creates an Outlook object. It then reads the first 50 addresses in each Outlook Global Address Book and sends a copy of itself to them. Melissa works on Microsoft Word 97, Microsoft Word 2000 and Microsoft Outlook 97 or 98 e-mail clients running under Windows or a Macintosh. Other e-mail clients can receive the virus, but Melissa requires Outlook to spread further. Notably, it was not compatible with Outlook Express.