Technical Details
Dangerous “Melissa”
-like macro virus. It infects documents
and global macros area (Normal template) on document closing. This virus
also spreads via email in the same way as “Melissa” does: On first infected
document opening on a computer the virus attempts to send itself to the
first sixty entries from the Outlook address book. The virus’ message has
infected document in attachment and:
Subject line: Important Message From
Text: Look what I found…
After first attempt to send itself via email the virus sets registry key value:
HKEY_CURRENT_USERSoftwareMicrosoftOfficeSixtieth Skeptic = “Where’s Jamie?”
Next time the virus checks this key to prevent duplicate sending.
In additional the virus drops its code into file “C:SS.BAS” and creates
Visual Basic Script in file “C:SS.VBS” that reinfects the Normal template
on each system reboot.
|