When an infected document is closed, the virus drops two files to the
Windows directory, "tempad.dll" and "tempnt.dll". These files are used
to infect the active document and the global template.
As an infection marker, the virus uses the word "Overlord".
Then it creates a text file, "c:\Himem.sys". This file is used to keep
names of the infected documents.
If user attempts to see the code via "Tools\Macros\Visual Basic
Editor", the virus hides itself by calling a stealth function. It
modifies the registered owner of Windows to "the Overlord". Then the
virus alters the "win.ini" in the Windows directory in a such way,
that a VBS file "overlord.b.vbs" will be executed when the system is
restarted. The the virus removes itself from the global template and
all active documents.
The "overlord.b.vbs" infects the global template and it uses the
"c:\himem.sys" to infect all files that are listed there.
When "Tools\Macros\Macro" is accessed, the virus uses another stealh
mechanism. It deletes its code from the global template and all opened
documents before the "Tools\Macros\Macro" dialog is shown. Later it
infects them back after the dialog is closed using different method of
[Analysis: Katrin Tocheva and Sami Rautiainen, F-Secure]