When an infected document is closed, W97M/Steak.A infects the global
template. While infecting, it creates two temporary files to the root
of the "C:" drive.
First file, "A1.sys", is used to infect the active document while the
another, "A1.inf", is used to infect the global template.
After the global template has been infected, the virus infects all
[Analysis: Sami Rautiainen, F-Secure]