Virus Database

TimerJack.1106

Description TimerJack.1106

It is not a dangerous memory resident parasitic virus. It hooks INT 21h and writes itself to the end of COM and EXE files (except SCAN, CLEAN, VSAFE, FINDVIRU, COMMAND) that are executed. Depending on the system date it also hooks INT 8 (timer) and corrupts the system time. The virus contains the text string:
Timer by some Jack

Check other viruses! Be aware! Use Antiviral Software

Macro.Word97.Opey

Description Macro.Word97.Opey

This macro virus contains fifteen macros in one module "A_OPEY_0x": greetings, OnlyYou, A_OPEY_05, filesave, fileclose, FileExit, FileNew, AutoOpen, AutoExec, FileSaveAs, FilePageSetup, fileprint, Fileopen, AutoClose, AutoExit.
The virus infects the global macros area on opening an infected document (AutoOpen), and infects other documents on run of any of its auto-macros. While infecting the virus disable menus: "Tools/Macro", "Tools/Customizeall", "Tools/Templates And Add-Ins". It also disable and hides the "Visual Basic" toolbar and turn off the Word virus protection (the VirusProtection option).
The virus changes the user's information:
UserName = "OPEY A."
UserAddress = "CNNHS B'92 PHILIPPINES (CNSC)"
UserInitials = "LOVE"

Depending on the current date the virus appends to the AUTOEXEC.BAT file one of the congratulations:
echo MERRY CHRISTMASS AND A HAPPY NEW YEAR !!!
echo HAPPY HALLOWEEN !!!
echo HAPPY VALENTINES DAY !!!
echo HAPPY LABOR DAY !!!
echo BONIFACIO DAY !!!
echo RIZAL DAY !!!
echo HAPPY INDEPENDENCE DAY !!!
echo HOLY WEEK !!!

and commands:
echo from: OPEY A.
pause

Macro.Word97.Opi

Description Macro.Word97.Opi

This is a stealth macro-virus. It contains six functions: AutoOpen, AutoClose, ToolsMacro, Toolscustomize, ViewVBcode, and OPIM. Upon opening a document, the virus disables the VirusProtection function. The virus replicates itself upon opening and closing documents (AutoOpen, AutoClose).
Upon entering the Tools/Macro menu, the virus sets the password "OPIM" for the current document and exits Windows. On Mondays, it replaces "the" with the "thee" string in the current document.

Home