It is an encrypted Word macro virus, it contains seven macros:
The virus infects the global macros area (NORMAL.DOT) on opening an
infected document (AutoOpen) and writes itself to documents that are saved
with new name (FileSaveAs).
On 22 May 1998 when Word is starting, the virus displays the MessageBox:
Belik Natasha demands:
Stop pollution of an environment!!!!!
Protect ozonian layer!!!
Pay the salary!!!!!
If the author of document is “Igor Daniloff”, the virus replaces the
AutoOpen and IDRWEBSCAN macros with harmless ones: new AutoOpen displays
In the WinWord6.0/7.0rus environment
the viruses are not distributed
DrWeb for WinWord
IDRWEBSCAN is replaced with do-nothing macro.
On entering the “Tools/Macro” menu the virus sets the document password
protection (password=”orhey”), and resets it after leaving “Tools/Macro”.