Virus Characteristics
This virus infects Word 97 documents and executes whenever a Word document is opened.
This virus checks to see if GlobalTemplate is infected. If the GlobalTemplate is already infected, the virus displays the following message:
Error245! MSWord will try to fix the problem.
If the GlobalTemplate is not infected, this virus deletes all code from the GlobalTemplate and inserts its viral code. This virus also deletes all macro code in the ActiveDocument and inserts its viral code into it. This virus disables the VirusProtection property.
This virus checks the date to see if the current day is the 17th. If it is not the 17th, the virus disables the Visual Basic Editor on the Items CommandBar under "Macro" options, saves the ActiveDocument and quits.
If it is the 17th, the virus' payload is executed. The payload runs by choosing random letters and symbols and displays them as a message.
The ActiveDocument is then minimized and the caption bar wording of the document in use is changed to:
...hmmm, strange!".
With MS-Word minimized, the virus then begins redrawing itself on the desktop, each redraw occurring at a different coordinate. The redraw generally happens so quickly it produces the effect of MS-Word splitting itself in two.
The virus then disables the Visual Basic Editor on the Items CommandBar under "Macro" options, saves the ActiveDocument and quits.