WM97/Marker-KQ

Name: WM97/Marker-KQ
Aliases: W97M.Marker.KQ
Type: Word 97 macro virus
Date: 10 April 2002

At the time of writing Sophos has received just one report of
this virus from the wild.

Description:

WM97/Marker-KQ has payloads which trigger on both opening and
closing of infected documents.

On opening an infected document between the 23rd and 31st of
July the virus displays the question

"Do you love mr occonor?".

When an infected document is closed between the 23rd and 31st of
July the virus changes the application title to

"bob oconnor certainly is gay and does practice brown love"

and displays the question

"Did You shag mr occonnor?".

If the user answers yes the virus displays the message

"my god I knew you was gay".

If the user answers no the virus displays a message which starts

" well you should".

The virus also changes the properties of infected Word documents
as follows:

Title: you love mr occonor?
Subject: STD'd
Author: you
Keywords: brown love
Comments: mr occonor still hangs outside your window at night.

Read the analysis at
http://www.sophos.com/virusinfo/analyses/wm97markerkq.html