VARIANT: Marker.A 

W97M/Marker.A is polymorphic. The polymorphism consists of adding a log at the end of the virus body for every infected user. This log contains information for system time, date, users name and address. 

The virus contains an infection marker in the beginning of its code: 

        <- this is a marker!

W97M/Marker.A saves its in a file called c:\netldv.vxd. To infect documents the virus export its code from global template to this file and after that deletes the file, so the user can't find it. 

VARIANT: Marker.C 

This version creates two files: 

        C:\HSF****.SYS (where **** are random characters)

and 

        C:\NETLDX.VXD

The first file is used to store the virus code and to add the log information. In this variant the log part starts with: 

        Logfile -->

The second file contains the actual code of the virus. 

It tries to upload the logfile to a virus exchange ftp site, codebreakers.org. This behaviour is similar to W97M/Caligula. 

This happens on the 1st of every month. 

VARIANT: Marker.D 

This variant is also known as "HSFX" because of the temporary file it creates is called "C:\HSFX****.SYS". Otherwise it's similar to Marker.C. 

This variant contains this text: 

        <- this is another marker!

VARIANT: Marker.O 

When an infected document is closed, W97M/Marker.O will infect the global template and every closed document thereafter. 

It contains a payload that is activated at every day from July 23rd to July 25th. At this time, the virus shows a dialog with the following text: 

    Did You Whish Shankar on his Birthday ?

If the user was opening the infected document, the no futher action will be taken regardless of which button, "Yes" or "No", is selected. 

However, if the message appears when an infected document is closed, and the user selects "Yes" button, then the following message will be shown: 

    Thank You! I Love You. You are wonderfull.

If the "No" button is selected, then the following message appears: 

     You are Heart Less.
     You Will Be Punished For This

Additionally, every document created during the time period mentioned above will contain the following text in big, green letters: 

    Happy
    BirthDay
    Shankar

When this virus infects documents or templates, it also alters the document summary information: 

    Title:      Are You suprised ?
    Subject:    Birthday
    Author:     LSK
    Category:   You Are Infected
    Keywords:   Birthday
    Comments:   Shankar's Birthday falls on 25th July.
                Don't Forget to wish him.

VARIANT: Marker.Q 

This variant is a mixture of two viruses: the replicating mechanism is from Marker.C and the payload is from Ethan.A. Instead of Marker.C this variant is not polymorphic. 

VARIANT: Marker.W 

This variant is functionally identical with W97M/Marker.C. 

VARIANT: Marker.X 

W97M/Marker.X uses a similar polymorphism as W97M/Class.D does and it contains an destructive payload which is activated at February 22nd, when the virus deletes all files from the root of the "C:" drive and shows a message box with the following header: 

    It's Murder

and the text: 

    That's Right

The virus also hooks the "Tools/Macros/Macro" and "Tools/Macros/Visual Basic Editor" menus replacing them with a message box with the text: 

     Error - Not enough memory!

VARIANT: Marker.Z 

W97M/Marker.Z is a modified variant of W97M/Marker.A. 

The infection marker has been changed to: 

    <- You didn't count on that, Jaba the Hutt!

Also the name of the file that the virus creates has been changed to "c:\zbf****.sys" where the asterisk ("*") is replaced with a random character. 

VARIANT: Marker.AE 

W97M/Marker.AE is functionally identical with W97M/Marker.O. 

VARIANT: Marker.AL 

This variant is similar to W97M/Marker.O. 

VARIANT: Marker.AN 

W97M/Marker.AN is a slightly modified variant of W97M/Marker.W. 

VARIANT: Marker.AQ 

W97M/Marker.AQ uses the same kind of polymorphism as W97M/Marker.A. However, this variant uses a different infection marker at the beginning of the virus code: 

    WebMaster

This virus also contains two destructive payloads. At 15th day of each even month, the virus deletes the contents of the entire active document; and at 13th day of each month, it changes the font of the active document to "Webdings". 

This variant infects when a document is opened or closed. It does not create any temporary files. 

VARIANT: Marker.AR 

W97M/Marker.AR is a sligtly modified variant of W97M/Marker.W. 

VARIANT: Marker.BN 

This variant activates its payload after June 2000. Than it change the file open directory to "C:\Windows\" and saves the active document as "AAiAA.DOC" where "i" is a number from 1 To 999999991. As a polymorphism it adds a log on the top of its code that contain information for the user's name, initials and address. 

VARIANT: Marker.BO 

W97M/Marker.BO contains a destructive payload. 

When an infected document is opened or closed, the virus first deletes all documents and templates from the Word's startup directory. 

Next it alters the Word's user information as follows: 

    User name:      JonMMx 2000
    User initials:  MeMeX
    Address:        JonMMx2000@yahoo.com

Later the virus uses this data to create a log at the end of its code. As a result of this sequence the log that suppose to collect information for all infected users contains almost the same data (except the day and time). 

If the day of the week is Sunday, W97M/Marker.BO drops a file "Jon.html" to the Windows directory and modifies the system registry in such way that this file will be used as a wallpaper. This wallpaper contains the following dark red text in an yellow backround: 

    a Poet For My Dear Love

    Dear Iin

    To the very best that happen in mylife
    Long ago and in my mind, I can see your face lonely and lost in time
    You were gone since yester month But the memories, never would dissapear
    I think of you, I THINK OF YOU.
    Yes it's true I can pretend. But the paint of blue, keep beat me till the end.
    Yes it's hard to understand. Why you leaving me and all we dreaming on
    Dear Iin, I close my eyes and see your face.  That's all I have to do to be with you.
    Dear Iin, altough I can not touch your face.  I know what I can do to be with you
    Long ago so faraway. But the light of blue, still living with me today.
    You were gone since yester month.  But the memories never would dissapear.

    Speed Hari

[Analysis: Katrin Tocheva and Sami Rautiainen, F-Secure]