This a stealth and polymorphic macro virus. It contains two modules
ThisDocument and VC. The first module contains auto-function that is
named AutoOpen in infected documents and AutoClose in infected NORMAL.DOT.
So the virus infects other documents on closing and affects the system on
opening an infected document.
While infecting the auto-function calls the UserForm_Click function that is
placed in the second virus module VC. The infection is performed by
export/import virus modules to the temporary C:ONE.SYS and C:TWO.SYS
files. The virus then modifies its code, so it is different in NORMAL.DOT
and infected documents. For instance, the virus inserts into NORMAL.DOT two
more functions to support its stealth ability: ViewVBCode and ToolsMacro.
The virus also inserts into the document comments that contains the name of
user, current time and path to active printer.
On July 28 the virus displays a window with the text: