Fandom

Malware Wiki

Marker

1,321pages on
this wiki
Add New Page
Comments0 Share

Virus.MSWord.Marker or Marker is a virus that written in VBS (Visual Basic Script).

Technical DetailsEdit

Marker is a family of Word 97 macro-viruses. They infect the macros area (Normal template) globally upon opening an infected document. Other documents are infected upon closing. Some virus versions also infect documents upon their opening. While infecting, the viruses append their code to the existing macro-code, if there is any macro. In the case that there are no macro(s), the viruses just copy their code to the document or the template.

They were named for the text comments in their bodies, and this comment is used by the virus to locate the top of the code in an infected file. There are several variants of this text, depending on the virus version:

<- this is a marker!
<- this is another marker!

The viruses of this family run a log of infected computers: each time while infecting a new computer, the viruses add their code text comments with the date of infection and user address (as it is stored in Windows).
Virus.MSWord01:17

Virus.MSWord.Marker

The viruses of this family indicate themselves in different manners. "Marker.a" in July starting from 23rd displays the messages: Did You Wish Shankar on his Birthday ?
Thank You! I Love You. You are wonderfull.
You are Heart Less. You Will Be Punished For This"Marker.c" and some other variants connect to a ftp site and send their log files there.

Marker.ayEdit

When MS Word opens a document, the infection procedure checks and infects this document. It removes all macros from the document and copies viruse from the global macros area.

This virus also unloads all loaded templates and add-ins and deletes all files in the Word startup directory. It also changes the Word user's information: UserName = "JonMMx 2000"
UserInitials = "MeMeX"
UserAddress = "JonMMx2000@yahoo.com"Upon the first infection of a computer and also on 1st of any month, the virus creates, in the Windows system, a directory file "Jon.html" and sets this file as desktop wallpaper. The file contains the text:

     a Poet For My Dear Love

          Dear Iin

  To the very best that happen in mylife
  Long ago and in my mind, I can see your face lonely and lost in time
  You were gone since yester month But the memories, never would dissapear
  I think of you, I THINK OF YOU.
  Yes it's true I can pretend. But the paint of blue, keep beat me till the end.
  Yes it's hard to understand. Why you leaving me and all we dreaming on
  Dear Iin, I close my eyes and see your face. That's all I have to do to be with you.
  Dear Iin, altough I can not touch your face. I know what I can do to be with you
  Long ago so faraway. But the light of blue, still living with me today.
  You were gone since yester month. But the memories never would dissapear.
       Speed Hari

Ad blocker interference detected!


Wikia is a free-to-use site that makes money from advertising. We have a modified experience for viewers using ad blockers

Wikia is not accessible if you’ve made further modifications. Remove the custom ad blocker rule(s) and the page will load as expected.