This macro virus infects MS Word documents as they are closed.
The code contains the following text string:
ORAGON
When an MS Word document is closed, the virus copies its code to all open documents and the normal.dot template.
The virus contains an internal infection count and increases it by 1 every time it infects a document. It adds blank lines to the end of its macro; the number of blank lines is the number of files infected.
It also turns off the Tools/Macro menu so the user will be unable to detect that the virus is present in the document.
On the 1st of every month, it changes the header of the current document window to the name of the system user and attempts to start the Office Assistant application.
