W97M.AntiSocial.E (Skeptic) Virus Information

Name: W97M.AntiSocial.E
Aliases: W97M.Skeptic, W97M_60thSKEPTIC
Type: Word 97 macro virus

Description:

W97M.AntiSocial.E is a Word 97 macro virus. It has the potential to spread by mailing itself out to the first 60 e-mail addresses in the Outlook address book, displaying the subject line, "Important Message From [username]," and body text, "Look what I found...". The infector document is sent as an attachment. This virus infects Word 97 documents, the Word Normal.dot template and Word documents opened or created once the system is infected.

When the infected file is opened, two dropper files [SS.BAS and SS.VBS] are put on the C:\ drive. The registry key,
HKEY_LOCAL_MACHINE\Software\MicrosoftWindows\CurrentVersion\Run is modified to ensure that SS.VBS is run whenever the system is restarted.

W97M.AntiSocial.E inserts a registry key,
"HKEY_CURRENT_USER\Software\Microsoft\Office\Sixtieth Skeptic
with the value, "Where's Jamie" to check its e-mail spamming function. If this value is present, the virus will not send itself out. If the value is not set, the e-mail spam function will activate.

Command AntiVirus detects and disinfects W97M.AntiSocial.E. As always, it is recommended that you consistently update your deffiles to ensure that you are protected against the latest threats as they emerge.

. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .