Threat behavior
Virus:W97M/Marker.DG is a Microsoft Word VBA Class module virus that infects Word documents and templates. This virus may display a message when working with infected documents during July 23 through 31, and alter document properties.
Installation
This virus exists in the class module named ThisDocument and the code activates when an infected document is opened in Microsoft Word versions that support the VBA macro language. The code is activated when specific Word events occur, such as opening or closing a document.
The virus code copies its entire contents to the class module ThisDocument of the Word global template named NORMAL.DOT. Any pre-existing code is overwritten during infection. The global template is loaded when Word starts up, activating the virus infection routine for every opened and closed document thereafter.
During infection, Virus:W97M/Marker.DG disables Word conversion notification, save prompt and macro security settings to minimize suspicion by the infected user.
Infected documents contain the following string ":-D you are marked!" in the VBA code, which also serves as the infection marker for the virus (hence the virus name).
Payload
-
Virus:W97M/Marker.DG displays a message box when an infected document is opened in July and during the days of the month 23 through 31. The message has the following properties:
Caption = "Happy Birthday Shankar-25th July.The World may Forget but not me"
Message content = "Did You Wish Shankar on his Birthday ?"
The message is posed as a yes or no question. If a response of Yes is given, a message is displayed with the content "Thank You! I Love You. You are wonderfull." Alternatively if the user selects No, the virus displays a message containing these words:
" You are Heart Less."
"You Will Be Punished For This"
It may also display the following text in green animation, "Happy Birthday Shankar".
-
As part of its infection routine, this virus sets the File Summary Info of the infected document as follows:
Title = "Are You suprised ?"
Subject = "Birthday "
Author = "LSK"
Category = "You Are Infected"
Keywords = "Birthday"
Comments = "Shankar's Birthday falls on 25th July. Don't Forget to wish him"
Prevention