FANDOM



W97M_60thSKEPTIC is a Word 97 macro virus which technically is a combination of the W97M_MELISSA and W97M_CLASS viruses.

Payload

When the infected file is opened, the virus will drop two files named SS.BAS and SS.VBS on the root of the C: drive. Next, the HKEY_CURRENT_LOCAL_MACHINE\Software\Microsoft\ WindowsCurrent\Version\Run registry key will be modified to automatically run C:\SS.VBS each time Windows is launched. When SS.VBS script is run, it will infect Word's global template (Normal.Dot). When repairing this virus, please make sure to remove this registry entry and also delete SS.BAS and SS.VBS files to avoid re-infection. In addition, the virus will automatically send an email to the first 60 email addresses registered in the Microsoft Outlook address book, with the SUBJECT line titled "Important Message From username" and the body of the email containing the text, "Look what I found…". The virus prevents itself from spamming email more than once by setting HKEY_CURRENT_USER\Software\Microsoft\Office\ Sixtieth Skeptic registry key with a value called "Where's Jamie?". Once this value is set, the virus will no longer send any further email. 

Community content is available under CC-BY-SA unless otherwise noted.