The virus contains three macros in one module “ThisDocument”:
Document_Close, Document_New, Document_Open. The virus spreads on opening,
creating or closing documents. While infecting it copies its code to all
opened documents and templates.
The virus adds document file name to the primary footer in the first
section of the infected document.