W97M/JB is executed when an infected document is opened. At this time
the virus adds the following text to the end of the document:
Jim The Great
The virus also adds the following footnote:
Then it infects the global template. After that all opened, closed or
created documents will be infected.
[Analysis: Sami Rautiainen, F-Secure]