WM/Switcher

Category: Viruses and Spyware Protection available since:14 Jun 1997 00:00:00 (GMT)
Type: Word macro virus Last Updated:14 Jun 1997 00:00:00 (GMT)
Prevalence: Small Number of Reports

Download Download our free Virus Removal Tool - Find and remove threats your antivirus missed

WM/Switcher contains a comment in the AutoExec macro with the text ***I'm a little pest!*** The LITTLE PEST self-propagating macro is by *Sly Ellga*, a guy who thinks it's funny to screw around with other people's data.

If File/Templates or Tools/Macro is selected when WM/Switcher is active, it displays a message box with the text 'Configuration conflict - menu item is not available'.

The virus has two payloads. The first is triggered when a document is closed when the number of seconds past the minute is 10 and involves the virus swapping randomly chosen digits around within the document.

The second payload involves WM/Switcher attempting to delete one set of files from the following list, starting at the beginning of the list and working down until it finds a set which matches at least one file: \EXCEL\*.XLS, \MSOFFICE\EXCEL\*.XLS, \ACCESS\*.MDB, \MSOFFICE\ACCESS\*.MDB, \WINDOWS\*.GRP, and *.HLP. The second payload is triggered if Word is started on an exact minute (i.e. the number of seconds past the minute equals zero).

download Try Sophos products for free
Download now