The virus code contains fifteen macros in one module “NewMacroses”. The
virus spreads on creating, opening, closing documents as well as on exiting
Microsoft Word. On infecting the system the virus copies original
NORMAL.DOT to user template directory with the WINDOT.DLL name, and
infected NORMAL.DOT with the WININF.DLL name.
On selecting the ToolsMacro menu the virus checks the number of opened
documents. If no documents are opened, the virus displays the message:
Microsoft is protecting your normal.dot from virus infection You can
only add macros to other documents
Otherwise the virus removes itself from normal template and on leaving the
ToolsMacro dialog window reinfects it.
While infecting the virus with probability 2% displays the assistants
I’m not feeling very vell .. AAARGHH!!!