For Home

Virus Profile: W97M/Opey.C

Threat Search
Print
   
Virus Profile information details
Risk Assessment: Home Low | Corporate Low
Date Discovered: 3/1/1999
Date Added: 9/3/1999
Origin:
Length:
Type: Virus
Subtype: Macro
DAT Required: 4003
Removal Instructions
   
 
 
   

Description

This is a virus detection. Viruses are programs that self-replicate recursively, meaning that infected systems spread the virus to other systems, which then propagate the virus further. While many viruses contain a destructive payload, it's quite common for viruses to do nothing more than spread from one system to another.

Indication of Infection

Methods of Infection

   

Virus Characteristics

The W97M/Opey.C virus was first listed as 'In The Wild' on The WildList in August 1999.

This virus infects Word 97 documents. To replicate, this virus requires the original version of MS-Office. Upgrading MS-Office to SR1 (service release 1) will stop this virus from replicating. Note however that W97M/Opey.C will infect MS-Word's NORMAL.DOT file regardless of the MS-Office version. This virus consists of the module 'A_OPEY_03'.

W97M/Opey.C will turn off the macro warning feature of MS-Word 97. W97M/Opey.C will disable the following popdown menus: 'View|Toolbars|Visual Basic', 'Tools|Macro' and 'Tools|Customize'. In addition, it disables the Shortcut keys 'Alt+F8' (Tools|Macro) and 'Alt+F11' (start Visual Basic Editor).

W97M/Opey.C changes the document properties author field to "OPEY A." and title to 'LOVE'. This change is not reversed during cleaning because VirusScan has no way of knowing what it was prior to the document's infection. To change it back, open the document, then choose File, then Properties.

W97M/Opey.C also changes the document's registered username to 'OPEY.A', registered user address to 'CNNHS B'92 PHILIPPINES (CNSC)' and registered user initials to 'LOVE'. This change is not reversed during cleaning because VirusScan has no way of knowing what it was prior to the document's infection. To change it back, open the document, then choose Tools, then choose Options, then click the User Information tab.

W97M/Opey.C contains several messages. However, instead of using the VBA MsgBox function, this virus instead modifies C:\AUTOEXEC.BAT and appends an ECHO <message> command. In addition, it appends a PAUSE command following each message. Unless the computer is restarted on the date of modification of C:\AUTOEXEC.BAT (or AUTOEXEC.BAT is run), the user may not see the message on the intended date.

Because modification to C:\AUTOEXEC.BAT occurs so frequently, it is possible the virus will make many additions [to C:\AUTOEXEC.BAT] during the course of editing a document. Unless the affected computer is never rebooted, the modification of C:\AUTOEXEC.BAT (with the many ECHOed messages and PAUSE commands) makes the existence of this virus very apparent.

Upon rebooting the computer, when C:\AUTOEXEC.BAT is executed, the message is displayed and the user is asked to 'Press any key to continue'. Pressing any key allows for the normal continuation of bootup.

The messages and dates are as follows:

On Appends to C:\AUTOEXEC.BAT

December 31st and January 1st: MERRY CHRISTMASS [sic] AND A HAPPY NEW YEAR !!!

November 1st: HAPPY HALLOWEEN !!!

February 14th: HAPPY VALENTINES DAY !!!

April 1st: HAPPY LABOR DAY !!!

November 30th: BONIFACIO DAY !!!

December 30th: RIZAL DAY !!!

June 12th: HAPPY INDEPENDENCE DAY !!!

April 1-30, Fridays & Saturdays: HOLY WEEK !!!

   
All Users :
Script,Batch,Macro and non memory-resident:
Use current engine and DAT files for detection and removal.

PE,Trojan,Internet Worm and memory resident :
Use specified engine and DAT files for detection. To remove, boot to MS-DOS mode or use a boot diskette and use the command line scanner:

SCANPM /ADL /CLEAN /ALL

Additional Windows ME/XP removal considerations


Users should not trust file icons, particularly when receiving files from others via P2P clients, IRC, email or other mediums where users can share files.

AVERT Recommended Updates :

* Office2000 Updates

* Malformed Word Document Could Enable Macro to Run Automatically (Information/Patch )

* scriptlet.typelib/Eyedog vulnerability patch

* Outlook as an email attachment security update

* Exchange 5.5 post SP3 Information Store Patch 5.5.2652.42 - this patch corrects detection issues with GroupShield

For a list of attachments blocked by the Outlook patch and a general FAQ, visit this link .
Additionally, Network Administrators can configure this update using an available tool - visit this link for more information .

It is very common for macro viruses to disable options within Office applications for example in Word, the macro protection warning commonly is disabled. After cleaning macro viruses, ensure that your previously set options are again enabled.