The W97M/Marker.AE virus was first listed as 'In The Wild' on The WildList in September 1999.
W97M/Marker.AE is quite different than W97M/Marker.C and W97M/Marker.D - two other 'Marker' variants also listed on The WildList.
W97M/Marker.AE is identical to W97/Marker.O with the following exceptions:
- W97M/Marker.AE includes the CommandButton11_Click() event handler. If called upon, this function attempts to print pages 19-46 of the active document.
- W97M/Marker.AE includes the CommandButton12_Click() event handler. If called upon, this function attempts to print pages 47-87 of the active document.
- W97M/Marker.AE includes the Main_Click() event handler. If called upon, this function attempts to print pages 1-18 of the active document.
W97M/Marker.AE infects Word 97 documents. It will turn off the macro warning feature of Word 97. This virus consists of a module called ThisDocument.
W97M/Marker.AE will infect MS-Word's NORMAL.DOT file
W97M/Marker.AE changes the document properties title to 'Are You suprised ? [sic]', subject to 'Birthday', author to 'LSK', category to 'You are Infected', keywords to 'Birthday' and comments to 'Shankar's Birthday falls on the 25th July. Don't Forget to wish him'. These changes are not reversed during cleaning because VirusScan has no way of knowing what they were before they were modified. To change them back, open the document, then choose File, then Properties.
W97M/Marker.AE contains the following string (which is never displayed to the screen) in its code:
":-D you are marked!"
Upon closing a document, if the date is the 23rd or greater and the month is July (in other words when the date is July 23rd through July 31), the virus displays a message box.
If the user clicks the 'No' answer box, a message is displayed.
Upon creating a new document, an animation is displayed to the screen. The animation is made up of large block letters that spell out 'Happy Birthday Shankar'. However, because the font size is so large (72pt) - on computers with a lower display resolution - 'Happy' may scroll off the top of the screen. The letters in the message are green in color with an animated sparkling background.