This virus contains one macro "autoOpen" in infected documents and two macros "AutoOpen" and "Disaster" in global macro area. It infects the global macro area (NORMAL.DOT) on opening an infected document and writes its code to documents that are opened.
In documents the virus keeps the infection routine in area of document's variables. While infecting NORMAL.DOT the virus ("AutoOpen" macro) creates the temporary file DISASTER.DEC, copies the document's variables to there and opens it. Newly created document contains a macro that infects the NORMAL.DOT.
While infecting a document the virus creates the same file DISASTER.DEC, writes its code to there and inserts this document into document's variables. Then the virus copies the "AutoOpen" macro to this document.
