It contains three macros, two of them have random selected names, the last one is AutoOpen in documents and AutoClose in NORMAL.DOT. To get these random names on infection the virus saves them in document's variables or in WIN.INI file.
To prevent duplicate infections the virus uses the description of the AutoClose macros. In infected files this description contains the string "Protects your computer". To detect itself the virus also creates the section "[I]" in WIN.INI file.
Starting from May and till December the virus removes itself from the system. It there is the text "Dark Master calling" in current document, and it is selected, the virus displays the MessageBox:
Microsoft WinWord DEMON
WINWORD HIDDEN DEMON
is happy to see his MASTER!!!
GREAT DAY !!!
This file is infected as # <¡«¼Ñ »« «½Ñ¡¿ >
