It creates 999, 999, 991 document files that start with "AA" and end with "AA". The files are in the Windows directory in drive C.

This code resides in the ThisDocument stream. It intercepts actions, such as opening and closing of file and viewing the visual basic source of the macro code.

It has a stealth feature that tries to hide its source to the end-user. A message box with the following text appears if the infected user tries to view it by pressing ALT+F11:
"The Visual Basic environment could not be initialized. Please run setup to install it correctly."

It will intercepts two standard macros in Word7:
Document_Open and Document_Close. When a file is opened, it looks for its signature "la macro de colombia xxx" to see if it is already in that file then It checks the global template (Normal.dot) for the existence of a macro code. If it finds the macro code, then it will removes the source from it. t will remov the user macro and even the virus that tries to infect it.

It does not allow any foreign macro code in the document. and it can be a safeguard for the integrity of the virus itself. If someone tries to create another variant that came from this code, it is immediately discarded.

The infection is executed when the document is closed. it checks whether the file is saved in document or template formats, before it flags the routine to infect the file. It does the same with the mechanism of the first macro. It eradicates any existing macro code, provided that the signature does not exist in the macro. then it suppresses the error-handling routine, so that if something goes wrong the virus automatically eradicates itself.