It is an extremely silly encrypted virus containing nothing except infection
routines. Summary length of its two macros (nf, autoclose) is just 286
Both virus macros contains infection routines. First macro infects global
area while closing an infected document (it is named “autoclose” in
infected documents and “nf” in NORMAL.DOT), second macro infects documents
that are closed (it is named “nf” in infected documents and “autoclose” in
NORMAL.DOT). So the virus exchanges names of these macros as several macro
viruses do – while infecting a file or global area it copies “nf” macro
with name “autoclose”, and “autoclose” with name “nf”.
NORMAL.DOT Infected files
Macro1 nf autoclose
Macro1 autoclose nf
While infecting the system the virus displays the string “Infected!”, while
infecting a file the virus displays “Traced!”.