Bench runs its infection routine in any of its auto-macros as well as Macro.Word97.Bench.a virus it disables macro viewing menus. It also sets the security level to minimal one. If global macros area is already infected, the virus displays the text "-=([B]MV.F)=-" to the application caption, and the text "-=([Bench] Macro Virus - Strain F)=-" to the status bar. On exiting MS Word the virus searches and infects all documents in current folder. On document saving it looks for anti-viruses NAV and F-PROT on the C: drive and remove their files, displays the application's caption "-=([B]MV.F])=-" and "-=([B]MV.F)=- / SAiNTS ViRii Dept. - Test Version" to the status bar. On opening the Visual Basic Editor the virus denies the operation and displays this message:
[Bench] Macro Virus - F You're not permitted to go there! Now you're gonna pay!
Then it saves the document with the "[Bench]" password, drops and executes a file infected by the Win9x.CIH virus, and then displays another message:
[B]MV.f I have just attempted to install the CIH virus on your system. I just felt like warning you...
- Bench Macro Virus