W97M.Marker

W97M.Marker is a common macro virus with a unique payload. Similar to W97M.Class, it adds its viral code to the "ThisDocument" VBA5 module, which by default is always in Microsoft Word 97 documents and templates. It also uses a randomly-named temporary text file while infecting. The random name is HSFxxxx.sys where xxxx is a randomly-generated number.

Protection

• Initial Rapid Release version December 21, 2000
• Latest Rapid Release version December 21, 2000
• Initial Daily Certified version December 21, 2000
• Latest Daily Certified version December 21, 2000
• Initial Weekly Certified release date pending

Click here for a more detailed description of Rapid Release and Daily Certified virus definitions.

Threat Assessment

Wild

• Wild Level: Low
• Number of Infections: 0 - 49
• Number of Sites: 0 - 2
• Geographical Distribution: Low
• Threat Containment: Easy
• Removal: Easy

Damage

• Damage Level: Low

Distribution

• Distribution Level: Low