When an infected document is closed, the virus drops two files to the Windows directory, "tempad.dll" and "tempnt.dll".
    As an infection marker, the virus uses the word "Overlord".
    It creates a file, "c:\Himem.sys".
    If user attempts to see the code by "Basic Editor", the virus hides itself by calling a stealth function.
    It modifies the registered owner of Windows to "the Overlord".
    Then it alters the "win.ini" in the Windows directory in a such way, that a VBS file "overlord.b.vbs" will be executed when the system is restarted.
    Then it removes itself from the global template and all active documents.
    The "overlord.b.vbs" infects the global template and it uses the "c:\himem.sys" to infect all files.
    Then "Tools\Macros\Macro" is accessed, the virus uses another stealh mechanism. It deletes its code from the global template and all opened documents before the "Tools\Macros\Macro" dialog is shown.