W97M/Onex.A is a simple Word macro virus, that infects the global
template when an infected document is opened. After that all opened
documents become infected. Beside replication the virus disables the
macro virus protection.
W97M/Onex.E contains a payload that activates based on a random
number. In a chance of 1:150 the virus attempts to delete
"c:\winnt\system32\ntoskrnl.exe" when an infected document is opened
or a document is opened in an infected system. Otherwise it functions
like the original W97M/Onex.A.
[Analysis: Sami Rautiainen, F-Secure; August 2001]