Threat Encyclopedia

Selected viruses, spyware, and other threats: sorted alphabetically

W97M/Marker.BN

W97M/Marker.BN is a macro virus operating in the Microsoft Word 97 environment. It is derived from the virus W97M/Marker.A. It uses the "class" method of infection – it attacks the module "ThisDocument" which is present as a standard in each Word document or template. It attacks the global template normal.dot and Word documents.
After opening an infected document the virus turns off the anti-virus protection, attacks the global template and the active document. It keeps record on infections in the form of lines with notes in front of its code. These lines contain data on the name of the Word user, his initials given at the installation, address, current date and time. Each of this data is on a separate line. As a result of this method the length of the virus code macro is gradually increasing.
The virus contains an activating routine which presents itself after the year 2000, always from June to the end of December. It consists of creating 999999991 copies of the infected document in the directory C:\Windows\; that is enough to fill each hard disk without any doubts.

© 1992-2004 Eset s.r.o. All rights reserved. No part of this Encyclopedia may be reproduced, transmitted or used in any other way in any form or by any means without the prior permission.