This encrypted macro virus contains six macros, four of them are original ones, the other two are copies and they may have different names in NORMAL.DOT and infected documents:
NORMAL.DOT Infected file
Macro1 Presentv Presentv
AutoOpen
Macro2 Presentw Presentw
FileSaveAs
Macro3 Presentz Presentz
FileSave FileSave
Macro4 vGojohnny vGojohnny
The virus infects global macros area on AutoOpen and writes itself to documents on FileSave and FileSaveAs.
In some cases the virus creates new document and inserts the texts to there:
NAIPESVOH REHM
It then prints the message to status line:
Starting Autosave
The virus contains the commented line:
Our devise - A copy of "Go Johnny Go" on every computer !
