Melissa Virus That Clogged Emails

Friday afternoon. The office is slowing down. Someone clicks open a Word document that a colleague just sent them, reads a line or two, and moves on. Nothing strange happens. No noise, no crash, no warning. But quietly, deep inside that machine, the document has already walked over to the email program, opened the address book, and posted copies of itself to fifty people. Fifty more offices. Fifty more address books. And in the mail server room down the hall, a tired computer that normally hums along happily is starting to feel the water rise around its ankles. By the time anyone understands what is happening, that water will be over its head.

What the Melissa virus was

Melissa appeared on 26 March 1999, and it belonged to a sneaky family called macro viruses. To understand it, you first need to know what a macro is. A macro is a small set of automated instructions hidden inside a document. Programs like Microsoft Word allow them because they can be useful — a macro might tidy up a table or repeat a boring task for you with one click. In simple words, a macro is a tiny robot living inside the file, waiting for permission to act.

Melissa was such a robot, but a badly behaved one. It hid inside Microsoft Word documents. When the document was opened in Word and macros were switched on, the robot woke up and got to work. It did not smash anything or rub out anyone’s files. Its talent was different, and in its own way far more powerful: it knew how to send email.

How the Melissa virus spread so fast

Melissa was first posted to an internet discussion group. It was offered as a document that supposedly contained passwords for websites. That bait worked because it promised something secret and valuable, and because a document feels safe. A program file might make people careful. A Word document asking you to enable its contents felt harmless.

The moment a victim opened the document and macros were enabled, Melissa grabbed Microsoft Outlook and mailed itself — the infected document attached — to the first 50 addresses in that person’s contact book. Fifty is the important number here. One reader did not pass it to one friend. One reader passed it to fifty friends, colleagues and family members, all in a single silent moment, without even knowing it had happened.

The email was cleverly dressed. Its subject line and message made it look like an important note coming from someone the receiver already knew. That is the trick that still powers infections today: we are guarded against strangers, but we relax around messages that appear to come from our own people. So the office manager opened it because it came from her assistant. The assistant’s cousin opened it because it came from the office manager. Each opening lit fifty more fires.

Melissa had one more playful habit. It could slip a joke sentence into Word documents the victim later saved — a line borrowed from The Simpsons, as reported at the time. It was a signature of sorts, a reminder that behind the flood there was a person enjoying his own cleverness.

The flood that shut down email

Melissa never tried to destroy a single file, and yet it caused chaos. Think about the maths. Every opened document sent fifty copies. Every one of those copies, if opened, sent fifty more. In a big company, thousands of employees could trigger this within the same hour. The emails piled up faster than the servers could deliver them, like a post office where every letter, once touched, photocopies itself fifty times before leaving the building.

That is exactly what happened in March 1999. Email systems at major companies and government bodies — reported at the time to include Microsoft, Intel and the US Marine Corps — buckled under the weight. Workers could not send or receive messages. Some organisations made the hard choice to switch their email off completely, because a silent inbox was better than a drowning one. From my side of the screen, the scariest part is that nobody’s information was stolen and nothing was broken — the worlds of these companies stopped simply because there was too much mail.

From the mail server’s point of view, it must have felt like a slow flood on a Friday afternoon. First a trickle of odd messages. Then a stream. Then thousands of copies of one cheerful little document demanding to be delivered at once, every copy spawning fifty more the moment it landed. Servers do not panic, but the people watching their screens certainly did.

The damage bill reflected all that lost time, cleanup and technical work. Estimates put the total cost at around $80 million.

The hunt for the person behind Melissa

The FBI led a fast manhunt. The investigators had one great advantage: documents carry hidden identifiers inside them, like faint fingerprints left by the software that created them. A tip traced through those hidden marks pointed the agents toward the document’s origin.

Within days they arrested David L. Smith, a programmer from New Jersey. Smith later pleaded guilty. In 2002 he was sentenced to 20 months in federal prison. According to reports from the time, he said he had named the virus after a dancer he had known in Florida.

His story carries a lesson of its own. Melissa was not built by a shadowy organisation with giant resources. One skilled person, one clever document and one Friday afternoon were enough to jam the email of some of the largest organisations on Earth.

How Melissa can still reach you today

You will probably never meet the original Melissa. Word and Outlook have changed a great deal since 1999, and modern software is far stricter about macros. But Melissa’s children are everywhere, because the recipe still works. Today’s version arrives as an unexpected invoice, a delivery note, a salary sheet or a “signed contract” attached to an email. The document opens, shows a blurry page, and asks you to press a button labelled “Enable Content” or “Enable Editing” so you can supposedly read it properly. That button is the modern version of switching macros on. Press it, and the hidden robot wakes up — only now it may steal passwords, spy on the computer or lock every file for ransom instead of mailing itself to your friends.

How to protect yourself from a Melissa-style attack

None of the defences here are complicated, and together they stop almost every attack of this kind.

• Never switch on macros in an unexpected document. If a file you did not ask for tells you to “enable content” to view it, treat that as the loudest alarm bell. A real invoice from a real company does not need a tiny robot inside it to show you the bill.
• Check with the sender through a different door. If a colleague’s document surprises you, message or call them on a separate channel and ask if they really sent it. Melissa’s whole power came from borrowed trust; one ten-second check breaks the chain completely.
• Beware of documents that promise secrets. Melissa spread first because it claimed to hold passwords. Free passwords, leaked lists and “secret” files are classic bait, in 1999 and today.
• Keep Word, your email app and your whole system updated. Updates quietly close the doors these viruses walk through. Melissa needed old software habits; updated systems ask far harder questions before letting a macro run.
• Slow down on Friday afternoons, deadlines and panics. Attackers love rushed people. A document that demands instant action is asking you to skip exactly the thinking that would protect you.
• Back up your important files somewhere separate. If a modern macro virus ever does lock or damage your documents, a clean copy kept elsewhere turns a disaster into an inconvenience.

Common questions

Did the Melissa virus delete people’s files?

No. Melissa was not built to destroy or steal files. Its damage came from the flood itself — it emailed itself to the first 50 contacts of every victim, and that mountain of messages overwhelmed and shut down email systems.

Why is it called Melissa?

According to reports from the time, its creator, David L. Smith, said he named it after a dancer he had known in Florida. He pleaded guilty and was sentenced in 2002 to 20 months in federal prison.

Can the Melissa virus infect my computer today?

The original Melissa is a museum piece now, because modern Word and Outlook handle macros far more strictly. But its method is alive and well: poisoned documents that ask you to “enable content” are still one of the most common ways malware gets in.

What should I do if a document asks me to enable macros?

Close it and do not press the button. If the document was supposed to come from someone you know, contact them through a different channel — a call or a separate message — and ask whether they sent it and why it needs macros.

How much damage did Melissa cause?

Estimates put the combined cost of the flood, the shutdowns and the cleanup at around $80 million. Email at places reported to include Microsoft, Intel and the US Marine Corps was overwhelmed, and some organisations switched their email off entirely to cope.

Sources

• Wikipedia — Melissa (computer virus): https://en.wikipedia.org/wiki/Melissa_(computer_virus)