Virus Database

Claire.821

Description Claire.821

It is a very dangerous memory resident encrypted parasitic virus. It hooks INT 21h and writes itself to the end of COM files that are executed. The virus also intercepts WriteHandle DOS function, and depending on its counter the virus replaces the text strings that are saved with the text: "Claire". The virus contains the text string:
Claire J, my love for you is absolute. (C) 1993 Scorpio / XDi

Check other viruses! Be aware! Use Antiviral Software

Macro.Word97.Opey

Description Macro.Word97.Opey

This macro virus contains fifteen macros in one module "A_OPEY_0x": greetings, OnlyYou, A_OPEY_05, filesave, fileclose, FileExit, FileNew, AutoOpen, AutoExec, FileSaveAs, FilePageSetup, fileprint, Fileopen, AutoClose, AutoExit.
The virus infects the global macros area on opening an infected document (AutoOpen), and infects other documents on run of any of its auto-macros. While infecting the virus disable menus: "Tools/Macro", "Tools/Customizeall", "Tools/Templates And Add-Ins". It also disable and hides the "Visual Basic" toolbar and turn off the Word virus protection (the VirusProtection option).
The virus changes the user's information:
UserName = "OPEY A."
UserAddress = "CNNHS B'92 PHILIPPINES (CNSC)"
UserInitials = "LOVE"

Depending on the current date the virus appends to the AUTOEXEC.BAT file one of the congratulations:
echo MERRY CHRISTMASS AND A HAPPY NEW YEAR !!!
echo HAPPY HALLOWEEN !!!
echo HAPPY VALENTINES DAY !!!
echo HAPPY LABOR DAY !!!
echo BONIFACIO DAY !!!
echo RIZAL DAY !!!
echo HAPPY INDEPENDENCE DAY !!!
echo HOLY WEEK !!!

and commands:
echo from: OPEY A.
pause

Macro.Word97.Opi

Description Macro.Word97.Opi

This is a stealth macro-virus. It contains six functions: AutoOpen, AutoClose, ToolsMacro, Toolscustomize, ViewVBcode, and OPIM. Upon opening a document, the virus disables the VirusProtection function. The virus replicates itself upon opening and closing documents (AutoOpen, AutoClose).
Upon entering the Tools/Macro menu, the virus sets the password "OPIM" for the current document and exits Windows. On Mondays, it replaces "the" with the "thee" string in the current document.

Home