This is a Word macro virus. It contains four macros: AutoOpen, SOK,
ToolsMacro (stealth), ToolsCustomize.
The infection routine is placed in SOK macros, which is called by AutoOpen
macro on opening a document. The virus does not infect the NORMAL.DOT – it
affects the files that are listed in recently used file list.
On September 9 depending on the system random counter it erases the files
by using one of masks: *.EXE, *.COM, *.OVL, *.BIN, *.TXT, *.DOC, *.DOT,
*.ZIP, *.ASM, *.DLL.