Marker.O Virus

Information about W97M/Marker.O Virus:

                    W97M/Marker-O is a modified variant of W97M/Marker virus. It is a Polymorphic Word macro virus. The polymorphism consists of adding a log at the end of the virus body for every infected user. This log contains information for system time, date, users name and address.

                     The virus contains an infection marker in the beginning of its code ":-D you are Marked!". The original W97M/Marker will contain the string "<- This is a Marker". It uses this string to find whether the file is infected or not. If the file is already infected, it will not infect the same file again.

                      While opening the document, If checks for system date. If the month is 7 and day is greater than or equal to 23 it will display the message "Did You Wish Shankar on his Birthday ?". It will alow the user to proceed.

                      While closing the document, it sets the application caption to "Happy Birthday Shankar-25th July. The World may Forget but not me". And also it display the message box "Did You Wish Shankar on his Birthday ?". If the "yes" option is selected it shows "Thank You! I Love You. You are wonderfull".

                     If "No" option is selected it shows "You are Heart Less." "You Will Be Punished For This".

                      The virus will display its payload from 23rd July to 31st July. There is no dangerous payload in the virus. However because of the internal infection routine it slows down the machine speed while opening and closing the documents. And also the infected user will get the message box every time while opening and closing the documents.

Removing Marker.O virus from your system:

                     Fire has incorporated W97M/Marker-O into its virus signature file years back. Fire users need not worry about this virus.

                     Macro Disable warning, Slower operation of word application are the main symptom of Word Macro viruses. If you receive "Shankar's birthday" message, you are infected with W97M/Marker-O virus.

                     A free download of FireLite [ 1100KB ] version is available to detect all viruses. If you find any virus, use registered windows version of Fire to remove. To get the registered version of Fire call us at 044-28170440 or mail to service@fireav.com or purchase Fire online using