The virus contains 7 macros:
The virus infects upon the opening or saving of documents (AutoOpen, FileClose). Upon opening a file, the virus turns off the VirusProtection options.
Upon saving a document, the virus erases files belonging to well known anti-viruses:
c:\program files\norton antivirus\Virscan2.dat c:\vdoc\*.* c:\f-prot\*.* c:\program files\antiviral toolkit pro\*.*
Upon entering the menu item Tools/Macro, the virus installs the password "
Bismark" on the document, and outputs the Balloon:
Word Macro Virus BisMark1 You Should Have Left Me Alone, I Was Not Hurting Anything. Now I'am Mad!
After this, the virus shuts down Windows. On Friday at 12:00, the virus inserts the autocorrect entries "the" on value "Word Macro Virus BisMark1, Written By Talon".