This macro virus contains eight macros in one module “Saturn”: AutoOpen,
AutoClose, Stealth, ToolsMacro, ToolsCustomize, ViewVBCode, Saturn, UMP.
The virus infects the global macros area on opening an infected document
(AutoOpen). Other documents get infection on their opening and closing.
While infecting the virus turn off the Word virus protection (the
VirusProtection option). Depending on the system date and random counter
the virus changes the computer’s name to “SOS” and set on document the
password “SOSxxx”, where “xxx” is a number from 1 to 333. On entering the
menu Tools/Macro, Tools/Customize or opening Visual Basic Editor it
displays one of the following messages:
Not enough memory to perform this operation
Impossible open this function
Function does not answer system requests
This program has performed an illegal operation and will be locked
This option at present not available
The virus then swaps reaction on mouse buttons and closes all documents.