This virus infects via the This Document module.
When an infected file is opened, the virus drops a file named sysboot.bin in the root directory (C:\).
Then, it infects the Global Template (Normal.dot) by copying its code to the This Document module.
The code is triggered by the Autoopen event, and that means while a document is opening, the virus code will be triggered and the current document will get infected. But prior to infection, the Macro checks if it is already infected; infected documents will not get infected for the second time.
     The Macro will trigger its payload under the following conditions:
1. If current day = 13 AND the Template is infected but not the current active document -- Backhand will save the active document in a template format and give it a password "Trim(Two)".
2. If current day = 13 AND the Template is infected but not the current active document AND current weekday = Friday -- on top of the payload mentioned in 1.,Backhand will also display the following messages:
"It's Friday 13th this is my lucky day, I hope it's yours too" "Have a nice day".
If this is not satisfied, another message in a Microsoft window will be prompted instead:
"Your document has been corrupted because of a bug in Word! Call Microsoft Customer Support, they can help you. When you call tell them this Bug-ID code (don't forget it!): Trim(Two)."
3. If the normal template is already infected but not the active document AND the current day is not 13 -- the active document will be saved as a template, and this time it is saved without a password.
4. If the current year >= 2000 -- the date will be changed to 1/1/1980.