Threat Encyclopedia

Selected viruses, spyware, and other threats: sorted alphabetically

W97M/Opey.A

W97M/Opey.A is a macro virus operating in the Microsoft Word 97 environment. It uses the "class" method of infection – it attacks the module "ThisDocument" which is present as a standard in each Word document or template. It attacks the global template normal.dot and Word documents. The infection is manifested by existence of the module with the name A_OPEY_03 in the template.
After opening the infected document W97M/Opey.A changes the name of the Word user to OPEY A, his address to CNNHS B'92 PHILIPPINES (CNSC) and initials to LOVE. It also alters the data in the document properties – it changes the author to OPEY A. and name to LOVE. Then it turns off the Word anti-virus protection and disables displaying of the warning window at writing into the template and at macros conversion. It also manipulates with the Word menu so that it deletes items Tools/Macro, Tools/Adjust and disables approach to the Visual Basic. It also disables the keyboard shortcuts ALT-F8 (Tools/Macro/Macros) and ALT-F11 (Tools/Macro/Editor of language Visual Basic).
After that the virus finds out whether there is a macro with the name A_OPEY_03 in the global template. If it does not find it the virus attacks the template. After infecting the global template W97M/Opey.A attacks documents at creating a new document, at opening, closing, saving and saving under a different name, printing and setting the print.
The virus contains an activating routine which on the dates December 25th, January 1st, February 14th and November 1st overwrites the file c:\autoexec.bat by text depending on the date. The text is:

@echo off
variable text
echo from: OPEY A.
pause

As the variable text the virus uses echo MERRY CHRISTMASS AND A HAPPY NEW YEAR!!! on December 25th and January 1st. On February 14th it changes the text to echo HAPPY VALENTINES DAY !!! and on November 1st to echo HAPPY HALLOWEEN !!!.

© 1992-2004 Eset s.r.o. All rights reserved. No part of this Encyclopedia may be reproduced, transmitted or used in any other way in any form or by any means without the prior permission.