This virus contains two macros:
It replicates on documents opening. The documents->NORMAL.DOT infection
routine does not have replicating instructions in its code. Instead of
ordinary ways of infection, it creates the temporary CyberShadow macro,
fills it with instructions of replication that are stored in virus text
constants, executes and then deletes.
The virus contains the comments:
Stealth Wishes by CyberShadow…
Thanks to SGWW !