Infection occurs when a user opens an infected Microsoft Word file in Word '97, 7.x, or 6.x. If either of these macros is present, the virus does not continue with the infection process. When the user clicks the OK button, the virus gains control. This virus has many variations.
Infection occurs when a file is opened.
Once the file is infected, there is a 20 percent chance that three randomly selected words within the file will be moved from their original location and inserted elsewhere. There is a 20 percent chance that the word wazzu will be inserted into the file in a random position. The virus code runs when an infected file is opened. All of these macros are encrypted using the Word execute-only feature except ToolsMacro. ToolsMacro is a procedural shell and is not encrypted.