The virus activates when an infected Excel workbook is opened. It turns off the virus protection in Excel, and then copies the infected workbook into the Excel startup folder as BASE5874.XLS. After the next Excel start the virus macros become globally available.
When a new computer is infected, the virus queries the first 4 bytes of the Excel installation drive, appends it to the string "IVID", then saves it in BASE5874.XLS as a document variable. Thus the virus keeps track on all computer it has infected.
The virus infects workbooks on closing. If the code module in the workbook contains less than three lines, then it is considered uninfected, and the virus copies its code there. During the infection the virus also copies the document variables that keep track on the infection path.
| 
