A macro virus that propagates by infecting Microsoft Word 97 and 2000 documents. It contains a module that turns off macro warning in Word 97. Verlor infects Word's NORMAL.DOT file and if a document is opened after infection its name is added to C:\HIMEM.SYS. The virus infects the document once it is closed and removed its name from C:\HIMEM.SYS.

When an infected user accesses Word's Visual Basic Editor (VBE) the virus changes the registry value to:
HKEY_LOCAL_MACHINE\software\RegisteredOwner = "the Overlord"

It searches the file WIN.INI for a [windows] section and once the section is found it adds the following entry to the [windows] section in WIN.INI:
run = %WINDIR%\overlord.b.vbs [%WINDIR%
= name of Windows directory]

It also drops two files in the Windows directory:
OVERLORD.B.VBS containing a Visual Basic Script (VBScript)
OVERLORD.B.DLL containing the virus source code as ASCII text

The virus then deletes itself from all open documents and the NORMAL.DOT file to hide its presence and opens VBE. If the Windows Scripting Host (WSH) is installed, OVERLORD.B.VBS is executed during Windows start-up to re-infect NORMAL.DOT using the virus source code in OVERLORD.B.DLL. All the documents listed in C:\HIMEM.SYS are opened and saved without any changes.

This virus also intercepts TOOLS | MACRO | MACROS macro
viewing commands and before the dialog is displayed it removes
all macros from open documents and NORMAL.DOT. When the
dialog is closed, the virus writes itself back to all open
documents and NORMAL.DOT.
OVERLORD.B.VBS and OVERLORD.B.DLL in Windows directory.
Modification of C:\HIMEM.SYS.
Registry key:
HKEY_LOCAL_MACHINE\software\RegisteredOwner set
to value "the Overlord".