Prilissa:

Infection:
Prilissa infects Word 97-files and spreads over to other PCs via Outlook. It sends itself in an email with the subject "Message from <Word 97 Username>" and the emailtext "This document is very important and you’ve GOT to read this!!!". This emails will be send only one time to the first 50 (!!)  entries in your adressbook.

Payload:
After the virus has sent the 50 emails it infects the NORMAL.DOT, so that every new opened or saved document will be infected too. At the 25th of december the real payload is started. Prilissa overwrites the AUTOEXEC.BAT with text and a format command for the harddisk drive C:

'@echo off'
'@echo Vine...Vide...Vice...Moslem Power Never End...'
'@echo Your Computer Have Just Been Terminated By -= CyberNET =- ‘Virus !!!'
'ctty nul'
'format c: /autotest /q /u'

When your PC is started the next time your harddisk will be formated and all data is lost. Notice that Windows NT-PCs are not befalled (They do not have the AUTOEXEC.BAT).
Likewise at the 25th of december in Word 97 the following advice will appear "(C) 1999 - CyberNET Vine... Vide... Vice... Moslem Power Never End... You Dare Rise Against Me... The Human Era is Over, The CyberNET Era Has Come!!! [OK]". After you have clicked on [OK] some figures in different forms and colours appear in the opened Word-document and another registry-key "HKEY_CURRENT_USER\Software\Microsoft\Office\" named "CyberNET" is created. This key will get the value "(C)1999 - Indonesia by AnomOke!". This entry ensures, that every Email to the first 50 Outlookadresses will only be send one time.

Removal:
An update of Dr.Solomons anti-virus software gives you an removal-possibility. A download is possible under http://vil.nai.com/vil/vm10441.asp

Remarks:
The release-date, the text, which will be in Word shown and the registry-key indicate, that the author of the virus is a religious indonesian.

More reports to this virus:
http://www.pandasoftware.com/vernoticia.asp?noticia=485&idioma=2
http://www.mcafee.com/viruses/prilissa/