The Melissa virus struck 6 years ago today

A member of the Virus Hall of Fame appeared today exactly 6 years ago. The famous Melissa virus started spreading on March 26, 1999.

I find the story of Melissa fascinating for a number of reasons.

First, Melissa made history as the first macro-virus with email worm traits. The first macro-viruses appeared back in 1995, but Melissa was the first one to combine macro-virus capabilities with the ability to spread via email. And how! Tens of thousands of infected emails spread within hours.

IT giants such as Microsoft and Intel were among the hardest hit. In fact, Microsoft even shut down their email system temporarily to prevent the virus from spreading further.

Yes, it was certainly one of the most serious epidemics in Internet history.

The new concepts and simple code attracted other virus writers who later used the Melissa source code to create dozens of other email worms.

Second, the Melissa outbreak was one of the few times when the author was quickly identified, arrested and sentenced.

David Lee Smith from New Jersey (USA) was arrested only 4 days after Melissa was detected. He was tried in May 2002 and sentenced to 10 years in jail and fined $2,500. However, he actually only served 20 months: the sentence was reduced in view of his cooperation with the prosecution and offers to help track down other virus writers.

Exactly how Smith assisted prosecutors is unclear, though he allegedly helped track down Simon Vallor and Jan de Wit. Ooddly enough, several well known virus writing groups ceased to exist precisely between 2000 and 2002.

David Smith was identified and arrested due to an interesting and at that time rarely used feature of MS Word. Even in 1999 MS Word saved information about the author of the document in the file properties. David put the first copies of Melissa in the alt.sex newsroom and all of the copies contained his data. The FBI had no trouble in tracking him down.

Third, I remember the day Melissa struck myself. I was not at Kaspersky Lab yet, but I was already interested in anti-virus technologies and ran my own Internet site devoted to anti-viru research. I gave a number of interviews to the local media and cleaned some friends’ computers, something that rarely needed to be done in the days before widespread Internet-based outbreaks.

Read more: