Name: Macro.Excel97.Papa. Category: Viruses Description: Details Macro.Excel97.Papa.a This macro virus is based on the code of Word macro virus "Melissa" . The virus replicates under Excel97, but it does not infect other workbooks. Instead of this the worm sends own copies in Email messages by using MS Outlook. Because of its infection method, this is much more worm than ordinary macro virus. The worm code contains one procedure Workbook_Open in module ThisDocument that automatically runs on opening workbook. To send its copies via email the virus uses VisualBasic abilities to activate other MS Windows applications and use their routines: the virus gets access to MS Outlook (if it is installed on the computer) and calls its functions. The virus gets from each Outlook address list of up to sixty addresses and sends to them a new message. This massage has: The subject: "Fwd: Workbook from all.net and Fred Cohen". Message body: "Urgent info inside. Disregard macro warning." The message also has attached workbook - it is current (worm's) workbook, and it is infected. Depending on the system random counter (in one case from 3) the worm floods either web site "Fred Cohen & Associates" or site with IP address 24.1.84.100.