WM97/Marker-KQ

Discussion in 'malware problems & news' started by FanJ, Apr 11, 2002.

Thread Status:
Not open for further replies.
  1. FanJ

    FanJ Guest

    Name: WM97/Marker-KQ
    Aliases: W97M.Marker.KQ
    Type: Word 97 macro virus
    Date: 10 April 2002

    At the time of writing Sophos has received just one report of
    this virus from the wild.

    Description:

    WM97/Marker-KQ has payloads which trigger on both opening and
    closing of infected documents.

    On opening an infected document between the 23rd and 31st of
    July the virus displays the question

    "Do you love mr occonor?".

    When an infected document is closed between the 23rd and 31st of
    July the virus changes the application title to

    "bob oconnor certainly is gay and does practice brown love"

    and displays the question

    "Did You shag mr occonnor?".

    If the user answers yes the virus displays the message

    "my god I knew you was gay".

    If the user answers no the virus displays a message which starts

    " well you should".

    The virus also changes the properties of infected Word documents
    as follows:

    Title: you love mr occonor?
    Subject: STD'd
    Author: you
    Keywords: brown love
    Comments: mr occonor still hangs outside your window at night.

    Read the analysis at
    http://www.sophos.com/virusinfo/analyses/wm97markerkq.html
     
Thread Status:
Not open for further replies.