When an infected document is closed, the virus shows the following
message in the Word's status bar:
TO BE OR NOT TO BE ?...
Then it infects the global template and every document that is closed
It also disables the Word's built-in macro virus protection when Word
is restarted and hooks "Tools/Macros/Macro" dialog rendering it
[Analysis: Sami Rautiainen, F-Secure]