Virus.MSWord.Switcher

Class Virus
Platform MSWord
Description

Technical Details


This is an encrypted stealth Word macro virus. It contains ten macros:
AutoExec, AutoOpen, AutoClose, FileClose, FileOpen, FileSave, FileSaveAs,
FilePrint, FileTemplates, ToolsMacro.


The virus infects the global macros area (NORMAL.DOT) on opening an
infected document, saving it, saving with new name, closing, printing and
entering Tools/Macro menu. Documents get infection when they are saved,
saved with new name or closed. The infection routine is placed in FileClose
macro, other macros call that macro to run infection.


On closing a document if the seconds are less than 10, the virus replaces
one random digit in current document. On entering Tools/Macro and
File/Templates menus the virus displays the MessageBox:


Configuration conflict – menu item is not available.