This virus contains one macro “autoOpen” in infected documents and two
macros “AutoOpen” and “Disaster” in global macro area. It infects the
global macro area (NORMAL.DOT) on opening an infected document and writes
its code to documents that are opened.
In documents the virus keeps the infection routine in area of document’s
variables. While infecting NORMAL.DOT the virus (“AutoOpen” macro) creates
the temporary file DISASTER.DEC, copies the document’s variables to there
and opens it. Newly created document contains a macro that infects the
While infecting a document the virus creates the same file DISASTER.DEC,
writes its code to there and inserts this document into document’s
variables. Then the virus copies the “AutoOpen” macro to this document.