Virus.MSWord.Shuffle

Technical Details

This is a stealth Word macro virus. It contains one macro in documents
(AutoOpen) and four macros in NORMAL.DOT (XXXXX, FileSaveAs, ToolsMacro,
FileTemplates).

The virus infects the global macros area (NORMAL.DOT) on opening an
infected document (AutoOpen) and writes itself to documents that are saved
with new name (FileSaveAs). The virus infects the documents in usual way,
while infecting the NORMAL.DOT the virus deletes all macros in there,
minimizes the Word window, and copies its macros string-by-string to the
global macros area.