When the first infected document is opened by Word the virus gets control and it checks whether the Global Template file (NORMAL.DOT) is infected. If it is not infected then the virus copies its macros to NORMAL.DOT and there by infecting it. The virus changes colors settings in the WIN.INI file which reflects on system output color this is the reason it is known as Colors virus.