When the infected file is opened under Word 97 it disables Macro virus protection of the MSWord, after this it will infect NORMAL.DOT which is a global template there by it transfers virus code in to that. Virus removes all the macros from the global template and inserts a procedure DisableAV(). This procedure carries code which disables Macro virus protection of Excel and Power Point in the registry.

Virus will invoke MS Excel and creates a file called BOOK1.XLS under Excel startup directory. If the file BOOK1.XLS is already present then it would not infect Excel. In the last virus will launch Power Point and searches for a module called Triplicate, if this module does not exists then it will insert a shape in the first slide Blank Presentation which is under template directory.

The infected file carries the following text which is visible in all the infected documents:

<!--1nternal--> Triplicate v0.1 /1nternal