This threat is detected as W97M/Generic. The virus contains two modules - ThisDocument, Kamilla and a form - frmAbout. On opening the infected document, the virus will replace text with
Your word processor is infected.
Code written by Otto Gutenberg.
The virus will then change the user details in File/Properties/Summary Info - Author = "Otto von Gutenberg", Subject = "Kamila atacks your word processor" and Comments = "CAUTION: Don't open". On any day between 28th December and 3rd January, the virus will change Word Application caption to "Merry Christmas!!! Nice holidays for you". Word's macro protection will also be disabled.
The virus will also display the message Happy new Year!!! Have a nice holiday, and delete the files with the following extensions in the current document folder - *.sys", "*.drv", "*.dll", "*.dos . If the day is 16th December, the virus will cause the machine to exit windows. W97M/Lami exports its code to C:\kamila.dll, C:\kama.dll and C:\kamafrm.dll. These files are not infected.
Tools/Macro displays the message "Your word processor is infected" and exits Windows. Tools/Visual Basic Editor will also delete the files with the following extensions in the current document folder - *.sys", "*.drv", "*.dll", "*.dos .