What Was the Melissa Virus? The Worm That Only Knew Fifty People

September 2, 2026

The lure was posted to a newsgroup called alt.sex, from a hijacked AOL account, and it promised passwords to more than eighty subscription pornography sites.

The file was called LIST.DOC. It did contain the list.

Melissa gets remembered as the first big email virus, which is roughly right, and as an act of destruction, which is not right at all. It deleted nothing, encrypted nothing and corrupted nothing. What it did was address fifty envelopes, on every machine it reached, until the mail infrastructure of a good chunk of corporate America stopped working.

What was the Melissa virus?

Melissa — detection name W97M.Melissa.A — was a Word 97 macro virus that appeared on 26 March 1999. It was written by David Lee Smith, of Aberdeen Township, New Jersey, and named, by his own account, after a dancer he had met in Florida.

It spread as an infected Word document. Opening that document in Word ran a macro, and the macro did four things:

Lowered Word's own macro security settings, so subsequent infected documents would open without a warning.
Wrote itself into Normal.dot, the global template — meaning every document saved on that machine from then on carried the virus too.
Opened Outlook via COM automation and mailed a copy of the infected document to the first fifty entries in the address book.
Set a registry flag so it would only do the mailing once per machine.

The message it sent looked like this:

Subject: Important Message From [sender's name]
Here is that document you asked for ... don't show anyone else ;-)

That is a well-built piece of social engineering and it is worth saying why. It arrives from someone whose name you know, because it genuinely is from their machine and their mail client. It references a document you might plausibly have asked for. And the wink at the end supplies a reason not to check with them first.

Fifty is the entire mechanism

The number is the design, and it is the part most retellings skip past.

Fifty messages leaving one desk over a few minutes is not an anomaly. It does not trip a rate limit, it does not look like a mail loop, and in 1999 it did not look like anything at all. A single infected machine is invisible.

But those fifty are colleagues, because address books are full of colleagues. Which means the second generation lands mostly inside the same organisation, and the third generation is fifty times that, and all of it is passing through the same mail gateway.

The result was not a slow burn. Organisations went from normal to non-functional inside a morning. Microsoft, Intel, Lockheed Martin and Lucent Technologies all shut down their own outbound mail gateways to stop the amplification — which is to say the containment measure was to turn email off.

Melissa did not need a payload. Fifty was the payload.

The payload it did have

There was one, and it is almost aggressively trivial.

If the current minute of the hour happened to equal the day of the month — so, at 26 minutes past any hour on 26 March — the macro typed a line into whatever document was open:

Twenty-two points, plus triple-word-score, plus fifty points for using all my letters. Game's over. I'm outta here.

It is Bart Simpson, from Bart the Genius. The same episode supplied Kwyjibo, which Smith had used as a handle. That was the whole arsenal: a quotation, inserted occasionally, into a file you were already editing.

Every subsequent mass-mailer had to be read against this. ILOVEYOU, fourteen months later, overwrote your files and harvested passwords. Melissa mailed itself and made a joke.

The $80 million figure

Every account of Melissa quotes roughly $80 million in damages, and the number is worth interrogating, because it is not measuring what people assume.

It is the FBI's estimate, and it made it into the sentencing. It is not a count of destroyed data, because no data was destroyed. It is a count of response: staff hours spent cleaning infected machines, gateways taken offline and brought back, mail queues drained by hand, the business done on the phone and by fax while email was down.

Estimates built that way are soft by nature — they depend entirely on which organisations reported, and how they costed an engineer's Saturday. Treat it as an order of magnitude, not a figure.

The number that is hard, and more interesting, is the reach. Melissa is generally put at over 100,000 machines across some 300 organisations in the first few days. It did that in a world with a fraction of today's mailbox count, from a standing start, on a Friday.

How he was caught

This is the part that deserves the shirt, and it is not the part that gets told.

Microsoft Office 97 wrote a Globally Unique Identifier into every document it saved. That was not a tracking feature in intent; it was infrastructure, used for OLE object identity. But on Windows, the GUID generation algorithm of the era mixed in the machine's network adapter address — its MAC address, permanently and uniquely assigned to that one card in that one computer.

So every Word document created on a given machine carried, invisibly, a number derived from that machine's network card.

Richard Smith — a security researcher, no relation to David Smith — knew this, because he had been writing about the privacy implications of exactly that identifier. When LIST.DOC surfaced, he pulled the GUID out of it. Then he pulled the GUIDs out of a set of older macro viruses posted by a writer using the handle VicodinES.

Same number. Same machine.

Word's revision log gave up names that had been used on the file. AOL, meanwhile, traced the hijacked account and the dial-up connection behind the newsgroup post. The two threads met.

David Lee Smith was arrested on 1 April 1999 — six days after the outbreak. He pleaded guilty in December 1999, cooperated with the FBI on subsequent investigations, and was sentenced in May 2002 to twenty months in federal prison and a $5,000 fine.

What Microsoft changed

Two things, in opposite directions, and both are still with you.

The macro security model was rebuilt. Office 2000 shipped with macro security set to warn by default, which is the direct ancestor of the yellow bar you still click through today. The unbroken line from Melissa to Enable Content is one of the longer causal chains in desktop security, and it is why macro-borne malware had to move to social engineering rather than autorun.

And the identifier came out. Microsoft shipped a patch and a removal tool after the privacy work, and stopped deriving the document GUID from the network adapter address. Which means the forensic technique that closed this case worked once, at scale, and then was deliberately removed from the world.

Why it still reads as modern

Strip the specifics and Melissa is a supply-chain problem in miniature. The document is authentic. The sender is real. The mail client is yours, the address book is yours, and the trust being spent is a relationship the attacker never had to build.

Nothing in the chain was forged. Every component behaved exactly as designed, and the composition was the flaw — which is the same sentence you end up writing about SUNBURST twenty-one years later, with a code-signing certificate standing where the address book used to be.

EXHIBIT 0021 — MELISSA

We put it on a shirt. An antique manual typewriter, drawn as an engraving, with a sheet in the platen headed LIST.DOC and a stack of finished pages beside it. One typebar has swung up, and a detail circle enlarges the slug on the end of it: the letter is chipped, broken along one edge.

Which means every page that machine ever typed carries the same flaw, in the same place, whether or not anybody meant it to. The callouts do the rest — FIRST 50 IN THE ADDRESS BOOK, THE FILE CARRIED A GUID, DERIVED FROM THE MAC ADDRESS, NO DESTRUCTIVE PAYLOAD.

Most people will read an old typewriter. Anyone who knows how this one ended will read the evidence.

That's the whole idea.

View the Melissa shirt — EXHIBIT 0021

Back to blog

Item added to your cart