Virus Characteristics
This virus infects Word 97 documents and executes when a Word document is opened, closed, or created.
This virus changes the author, title, subject, keywords, and the comment property of the ActiveDocument.
When a document is closed, the virus checks to see if the date is February 3 or 26. This virus creates a password "Dariem" which is needed to open the ActiveDocument. This virus stores the code from the ActiveDocument to a variable. If the variable is empty, the virus assigns the source code from the GlobalTemplate to a variable, deleting the code from the ActiveDocument, and inserting its viral code from the variable into the ActiveDocument.
If the variable does not contain an infection marker, the virus deletes the code of the ActiveDocument and inserts the exact same code from the variable to the ActiveDocument.
When a Word document is created, this virus disables the VirusProtection, SaveNormalPrompt & ConfirmConversions properties. This virus changes the author, title, subject, keywords, and the comment property of the ActiveDocument. This virus assigns the source code from the GlobalTemplate to a variable, deletes the code from the active document, and copies the code into the ActiveDocument from the variable.
If the date is February 3 or 26, this virus changes the footer text to "MENSAJE", and disables the DocumentMap and the Header and Footer menu items under the View menu. On any other day this virus sets the footer text to an empty string. This virus disables the ALT-F11 hotkey (Visual Basic Editor) and the ToolsMacro menu item.
When a Word document is opened, this virus stores the code from the GlobalTemplate to a variable. If the variable is empty, this virus assigns the source code from the GlobalTemplate to a variable, deleting the code from the ActiveDocument, and inserting its viral code from the variable into the ActiveDocument.
If the variable does not contain an infection marker, this virus deletes the code of the GlobalTemplate and inserts the exact same code from the variable to the GlobalTemplate.