Virus Database

Macro.Word97.Antisec

Description Macro.Word97.Antisec

This macro virus infects MS Word documents and normal.dot template files. The virus itself is a macro named 'AntiTheSecond' and it seems that the author intended it to act as an antivirus against the macro virus TheSecond.
When an infected file or template is opened, the virus creates an export file named Anti.tmp in the MS Word start directory. The macro code is saved in this file. The virus then checks all MS Word documents which are currently open for the macro module of TheSecond virus. If this module is detected, the virus will cause a MessageBox to be displayed. The MessageBox contains the following text in Russian:
ïÂÎÁÒÕÖÅÎ ×ÉÒÕÓ The Second × ÄÏËÕÍÅÎÔÅ <ÉÍÑ ÆÁÊÌÁ> !
Translation: The Second has been detected in the document 'name of file'!
It then deletes the contents of the virus module, without deleting the module TheSecond (which is a type of vaccine for files). If this is successfully completed, a MessageBox in Russian will be displayed on the screen:
äÏËÕÍÅÎÔ <ÉÍÑ ÆÁÊÌÁ> ×ÙÌÅÞÅÎ!
Translation: The document <name of file> has been cleaned!
If the document does not contain the virus TheSecond, Antisec will infect it by writing its code to the document from the file Anti.tmp. A MessageBox in Russian will then be displayed on the screen:
áÎÔÉ×ÉÒÕÓ ÄÏÂÁ×ÌÅÎ × ÄÏËÕÍÅÎÔ <ÉÍÑ ÆÁÊÌÁ> !!!
Translation: An antivirus has been added to the document <name of file> !!!

Check other viruses! Be aware! Use Antiviral Software

Opic family

Description Opic family

These are not dangerous nonmemory resident encrypted parasitic viruses. They search for EXE files in current and parent directories, then write themselves to the end of the file. "Opic.745" infects files on C: drive only.
Depending on the system date and time the viruses beeps by the PC speaker. The "Opic.727" virus then creates two subdirectories: "Odessa!" and "Opic" and writes to the end of CONFIG.SYS file the text:
REM-Odessa Virus (c) Opic [CodeBreakers 98]

The "Opic.745" virus also contains the text:
Odessa.B (c) Opic [Codebreakers 1998]

Oppressor.559

Description Oppressor.559

It is not a dangerous memory resident parasitic virus. It hooks INT 21h and writes itself to the end of EXE files that are executed. While executing the infected files perform INT 5 (Print Screen) call. The virus contains the text string:
Oppressor-B, v0.2905, rev.A, no.95.021, by The Heretic

Home