It is a polymorphic and stealth macro virus. It contains 8 macros in one
module called “Clara”: GetRandom, Effect, AutoOpen, AutoClose, ToolsMacro,
ViewVBCode, ToolsCustomize, FileTemplates.
It infects the global macros area on opening an infected document
(AutoOpen) and infects other documents on opening or saving (AutoOpen,
The virus turns off the Word virus protection (the VirusProtection option).
It also disables the Tools/Macro, File/Templates, View/VBCode,
Tools/Customize menus (stealth). The virus’ polymorphic engine inserts random comments of random length into the virus code while
On the 1st of any month the virus displays a “Balloon” and MessageBox:
The virus also contains the comments:
Thanks to Pyro