This virus contains two original macros that are copied to five macros while infecting the NORMAL.DOT:
Documents NORMAL.DOT
AutoOpen AutoOpen
AutoClose
Crypt Crypt
ToolsMacro
FileTemplates
The virus replicates itself to the global macros area on opening an infected document, and infects documents that are opened or closed.
On entering the Tools/Macro or File/Templates menu the virus depending on random number sets for current document random numerical password and displays the MessageBox:
ULTRAS
Crypt by ULTRAS [Rioters]
