This is an encrypted macro virus. It contains four macros that have different names in infected documents and NORMAL.DOT:
Documents NORMAL.DOT
AutoOpen YYYAO
XXXAO AutoOpen
XXXFSA FileSaveAs
XXXFS FileSave
PayLoad PayLoad
The virus infects the system on opening an infected document (AutoOpen) and writes itself to other documents on opening and saving (AutoOpen, FileSave, FileSaveAs).
On each infection the virus copies the WINWORD.HLP file to TEMPLATESn.WRD file, where 'n' in number of infection. In case of error the virus displays one of MessageBoxes:
DúleOitč upozornini
!!! Tohle způsobil virus Bertik.1 !!!
!!! Made by virus Bertik.1 !!!
