This is a polymorphic Word macro virus. It contains only one macro in infected documents - FileSave, but while infecting the system it creates two macros - FileSave and ToolsMacro (stealth). The virus replicates itself when documents are saved (FileSave). While infecting the virus creates the Vicissitator macro, copies its code to there and edits it (polymorphic engine). The virus then copies to the document the result macro with name FileSave.
While infecting NORMAL.DOT the virus writes the text to the ToolsMacro macro:
You have been Infected by the Vicissitator Macro Virus.
(C)1997 CyberYoda A Member of the SLAM Virus Team
