This Macro virus infects WORD templates and documents. Upon execution, if MIRC is present on the system (particularly C:\MIRC\MIRC32.EXE), it will copy the original
C:\MIRC\SCRIPT.INI to C:\MIRC\SCRIPT1.INI and reload the modified C:\MIRC\SCRIPT.INI.
Then this macro creates a bogus MIRC chat message that encourages users to open an infectious document file,
c:\WINDOWS\STORY.DOC, sent from NICK.

Here are some of the distinctive MIRC texts and messages that help you to identify this worm virus:
1. Mirc Worm 4 Jack-In-The-Box. By SimpleSimon 12>9>12.
2. "I am on irc. Hey, I cannot talk right now but I wanted to send you this file. It has a funny story you should read, and also has macros inside that protect you from a lot of viruses. Just open the document, enable the macros, and if you are infected it will get rid of the virus".
3. "Thanks for the invite[sic]. I am a little busy so I cannot talk much now. I thought you might want to look at this file I got. It has a funny story and also has macros in it which get rid of any macro viruses. Just enable the macros when the prompt comes up and it will scan for any viruses and clean them."

This macro virus sends email, on a random manner, to the following websites and e-mail addresses:
mirc.com, georgecarlin.com, carrottop.com, anvdesign.net, Symantec.com,
drsolomon.com, www.bocklags.wisc.edu, ebay.com
evrt@avp.com,samples@datafellows.com,
virus_research@nai.com and tech_support@nai.com .

During MIRC disconnection, the modified SCRIPT.INI will be removed and the
SCRIPT1.INI renamed back to SCRIPT.INI.