If the name of the registered user is "S. Bach", and an infected
document is opened the virus displays a message in German:
Ich bin wieder hier!
which means "I'm here again!" in English.
At March 19th the virus activates its payload when an document is
closed. At this time the virus will change the shape of Word window to
Then it uses Office Assistant to show two messages. The first message
(DocumentName) was infected by MFV (My First Virus)
where "(DocumentName)" is replaced with either the document name or
the name of the global template, "Normal.dot".
The second message is:
This virus is not harmful. Belive me!
Your window was only deformed, not more!
This virus is freeware. You may give it to anyone!
After the virus has modified the appearance of the Word window, it has
to be closed from task bar or using a hot key (Alt+F4) since the menu
bar is partially invisible.
[Analysis: Katrin Tocheva and Sami Rautiainen, F-Secure]