The W97M/Opey.C virus was first listed as 'In The Wild' on The WildList in August 1999.
This virus infects Word 97 documents. To replicate, this virus requires the original version of MS-Office. Upgrading MS-Office to SR1 (service release 1) will stop this virus from replicating. Note however that W97M/Opey.C will infect MS-Word's NORMAL.DOT file regardless of the MS-Office version. This virus consists of the module 'A_OPEY_03'.
W97M/Opey.C will turn off the macro warning feature of MS-Word 97. W97M/Opey.C will disable the following popdown menus: 'View|Toolbars|Visual Basic', 'Tools|Macro' and 'Tools|Customize'. In addition, it disables the Shortcut keys 'Alt+F8' (Tools|Macro) and 'Alt+F11' (start Visual Basic Editor).
W97M/Opey.C changes the document properties author field to "OPEY A." and title to 'LOVE'. This change is not reversed during cleaning because VirusScan has no way of knowing what it was prior to the document's infection. To change it back, open the document, then choose File, then Properties.
W97M/Opey.C also changes the document's registered username to 'OPEY.A', registered user address to 'CNNHS B'92 PHILIPPINES (CNSC)' and registered user initials to 'LOVE'. This change is not reversed during cleaning because VirusScan has no way of knowing what it was prior to the document's infection. To change it back, open the document, then choose Tools, then choose Options, then click the User Information tab.
W97M/Opey.C contains several messages. However, instead of using the VBA MsgBox function, this virus instead modifies C:\AUTOEXEC.BAT and appends an ECHO <message> command. In addition, it appends a PAUSE command following each message. Unless the computer is restarted on the date of modification of C:\AUTOEXEC.BAT (or AUTOEXEC.BAT is run), the user may not see the message on the intended date.
Because modification to C:\AUTOEXEC.BAT occurs so frequently, it is possible the virus will make many additions [to C:\AUTOEXEC.BAT] during the course of editing a document. Unless the affected computer is never rebooted, the modification of C:\AUTOEXEC.BAT (with the many ECHOed messages and PAUSE commands) makes the existence of this virus very apparent.
Upon rebooting the computer, when C:\AUTOEXEC.BAT is executed, the message is displayed and the user is asked to 'Press any key to continue'. Pressing any key allows for the normal continuation of bootup.
The messages and dates are as follows:
On Appends to C:\AUTOEXEC.BAT
December 31st and January 1st: MERRY CHRISTMASS [sic] AND A HAPPY NEW YEAR !!!
November 1st: HAPPY HALLOWEEN !!!
February 14th: HAPPY VALENTINES DAY !!!
April 1st: HAPPY LABOR DAY !!!
November 30th: BONIFACIO DAY !!!
December 30th: RIZAL DAY !!!
June 12th: HAPPY INDEPENDENCE DAY !!!
April 1-30, Fridays & Saturdays: HOLY WEEK !!!