Friday Afternoon

March 26, 1999. A Word macro arrives as list.doc from someone you know. By Monday the mail servers at Intel and Microsoft are holding tens of thousands of copies.

Type

Classic

Difficulty

Beginner

Era

1990s

Time

7 min

Briefing

The attachment is `list.doc`, same 40-name Outlook address book blast that made Melissa famous. You do not have live SMTP here. Read the samples the gateway already caught.

Your role

Email administrator watching queue depth spike during Melissa's first exponential hour.

Objective

From quarantine excerpts alone, identify the propagation mechanism and why the From: address looked trustworthy.

Terminal environment

user: analyst
host: msg-gw-east
cwd: /var/mail/exchange-mirror
steps: 3

Enter the terminalAbout 7 minutesSafe simulation

Safety note. This is a safe reconstruction. All systems, files, hosts, credentials, and outputs are simulated. Do not use these techniques on systems you do not own or have explicit permission to test.