The following has been derived from information provided by Trend Micro.

Virus Characteristics

This is a destructive macro virus that infects documents and templates upon closing the target file. This virus carries a payload that triggers when Visual Basic Editor is invoked on the 15th of any month. The payload deletes the command bars "FILE-PAGE SETUP...", "FILE-PRINT PREVIEW", "FILE-PRINT...", "FILE-EXIT", "FILE-NEW...", "FILE-OPEN..." and "FILE-CLOSE".

This macro virus contains eight macros, including AutoClose, ToolsMacro, ViewVBCode, TM, VVBC, Document_Close, Document_New and Document_Open. ViewVBCode is used to check for the payload. The TM and VVBC macros display a message box when activated:

"This program has performed an illegal operation and will shut down."

The virus, however, does not seem to call these macros. When Document_Close is activated, the virus checks certain strings in the document body and the Normal template to determine whether or not they are infected. If infected, the virus overwrites their contents with the virus code.

The virus also generates a random number from 0 to 0.999. If this number is less than 0.3, the virus modifies the file properties by changing:

TITLE to ETHAN FROME
AUTHOR to EW/LN/CB
KEYWORDS to ETHAN