This is a Chinese encrypted Word macro virus. It contains four macros:
Joke, AutoExec, AutoOpen, ToolsMacro.
On opening a document (AutoOpen) the virus creates the temporary “Back”
macro, fills it with its infection routine that reads from document’s
AutoText, executes (infects the NORMAL.DOT) and deletes. The same for
Depending on system random counter and day of week the virus displays the
message (but does not format the disk):
Formatting C: . . .
Formatting C: % completed…
The virus then displays the MessageBox:
Format C:Hard disk C: format complete.
You must reboot to take effect !
On pressing “Ok” the virus exits Windows.