Virus.MSWord.Marker or Marker is a virus that written in VBS (Visual Basic Script).
Marker is a family of Word 97 macro-viruses. They infect the macros area (Normal template) globally upon opening an infected document. Other documents are infected upon closing. Some virus versions also infect documents upon their opening. While infecting, the viruses append their code to the existing macro-code, if there is any macro. In the case that there are no macro(s), the viruses just copy their code to the document or the template.
They were named for the text comments in their bodies, and this comment is used by the virus to locate the top of the code in an infected file. There are several variants of this text, depending on the virus version:
<- this is a marker!
<- this is another marker!
The viruses of this family indicate themselves in different manners. "Marker.a" in July starting from 23rd displays the messages:
Did You Wish Shankar on his Birthday ?
Thank You! I Love You. You are wonderfull.
You are Heart Less. You Will Be Punished For This"Marker.c" and some other variants connect to a ftp site and send their log files there.
When MS Word opens a document, the infection procedure checks and infects this document. It removes all macros from the document and copies viruse from the global macros area.
This virus also unloads all loaded templates and add-ins and deletes all files in the Word startup directory. It also changes the Word user's information:
UserName = "JonMMx 2000"
UserInitials = "MeMeX"
UserAddress = "JonMMx2000@yahoo.com"Upon the first infection of a computer and also on 1st of any month, the virus creates, in the Windows system, a directory file "Jon.html" and sets this file as desktop wallpaper. The file contains the text:
a Poet For My Dear Love Dear Iin To the very best that happen in mylife Long ago and in my mind, I can see your face lonely and lost in time You were gone since yester month But the memories, never would dissapear I think of you, I THINK OF YOU. Yes it's true I can pretend. But the paint of blue, keep beat me till the end. Yes it's hard to understand. Why you leaving me and all we dreaming on Dear Iin, I close my eyes and see your face. That's all I have to do to be with you. Dear Iin, altough I can not touch your face. I know what I can do to be with you Long ago so faraway. But the light of blue, still living with me today. You were gone since yester month. But the memories never would dissapear. Speed Hari