FRISK Software International


Summary of W97M/Opey
Alias:Opey
 
Jump to:
Brief description
Technical description

Brief Description
W97M/Opey is a Word 97 macro virus.

When an infected document is opened the virus infectes the global template and modifies the current user settings as follows: User name is changed to "OPEY A.", address is changed to "CNNHS B'92 PHILIPPINES (CNSC)" and initials are changed to "LOVE". It also removes the "Tools/Macros" and "Tools/Customize..." menu selections, "ALT-F8" and "ALT-F11" keyboard shortcuts, and disable the "Visual Basic" toolbar.


Technical Description
After the global template has been infected, the virus will infect every document that is opened, closed or saved thereafter.

The virus activates its payload at the holidays mentioned below. It then adds a message to the end of "C:\AUTOEXEC.BAT" file, so the message will appear when the system is restarted.

At December 25th and January 1st the message is:


    MERRY CHRISTMASS AND A HAPPY NEW YEAR !!!
    from: OPEY A.
November 1st the message is:



    HAPPY HALLOWEEN !!!
    from: OPEY A.
and February 14th it will be:


    HAPPY VALENTINES DAY !!!
    from: OPEY A.
Then the execution of "AUTOEXEC.BAT" will stop until a key is pressed.

VARIANT: Opey.C

W97M/Opey.C is a modified variant of W97M/Opey.A. It contains some additional messages that are added into the "C:\AUTOEXEC.BAT":

At April 14th:


    HAPPY LABOR DAY !!!
    from: OPEY A.
November 30th:


    BONIFACIO DAY !!!
    from: OPEY A.
December 30th:


    RIZAL DAY !!!
    from: OPEY A.
June 12th:


    HAPPY IDENPENDENCE DAY !!!
    from: OPEY A.
and finally in every Thursday, Friday and Saturday in April:


    HOLY WEEK !!!
    from: OPEY A.
VARIANT: Opey.D

W97M/Opey.D is a slightly modified variant of W97M/Opey.A. It doesn't remove "Tools/Customize..." menu selection but replaces it with a code that infects the active document.

VARIANT: Opey.H

W97M/Opey.H is a modified variant of W97M/Opey.A. The number of dates when messages are appended into the "C:\AUTOEXEC.BAT" has been increased sligtly.

This variant also adds six AutoCorrection entries, which causes that Word will replace the the following words with a string:


    Author          Author The Crazy Man
    President       President Mr. Josep Estrada
    M.Mla.          Metro Manila Philippines
    I am            I am The Crazy Man
    I'm             I'm The Crazy Man
    Who is          Who is the Crazy Man
The virus also changes the current user information of Word as follows:


    User name:      Crazy Man
    User address:   LBTMM B'99 PHILIPPINES
    User initials:  Crazy
Finally it modifies the active document summary:

    Author:         Crazy Man
    Title:          Crazy
    Manager:        MMA
    Company:        Crazy Man Company
    Comments:       HELLO I am the Crazy Man From the Crazy World of
                    Computer. Don't you worry I'm not as crazy than
                    you tink...
The virus also hooks the "Tools/Macros/Macro" menu, replacing it with a code that inserts the following text to the active document:


    Aha!!! You Wan't to know my code...
    Kill me first
It then saves the active document and quits Word.


[Analysis: Sami Rautiainen, F-Secure]
 


Stay up to date with important developments via e-mail.
Stay up to date with life cycle policies for F-PROT Antivirus for Windows.
Virus news and information directly to your desktop.
Definitions of common antivirus terminology.
For further virus information, please try our partners' websites:

Authentium

perComp Verlag
(in German)
 

agoat@klaki.net argentina@f-prot.com argentina@frisk.is argentina@complex.is argentina@f-prot.is argentina@frisk-software.com argentina@f-prot.net argentina@f-prot.co.uk brazil@f-prot.com brazil@frisk.is brazil@complex.is brazil@f-prot.is brazil@frisk-software.com brazil@f-prot.net brazil@f-prot.co.uk malta@f-prot.com malta@frisk.is malta@complex.is malta@f-prot.is malta@frisk-software.com malta@f-prot.net malta@f-prot.co.uk a.bjani@f-prot.com a.bjani@frisk.is a.bjani@complex.is a.bjani@f-prot.is a.bjani@f-prot.co.uk a.bjani@frisk-software.com a.bjani@f-prot.net z.fifl@f-prot.com z.fifl@frisk.is z.fifl@complex.is z.fifl@f-prot.is z.fifl@f-prot.co.uk z.fifl@frisk-software.com z.fifl@f-prot.net strumpuri@complex.is strumpure@complex.is strumpuru@complex.is