Macro Virus Table - Defense Technical Information Center

MACRO
Macro Viruses
Name: AccessiV.b
Aliases: AccessiV.b, A97M.AccessiV.b, Type: Macro.
Disk Location: Program overlay files. Features: No damage, only replicates.
Damage: No damage, only Size: Adds macros to See Also: AccessiV
replicates.
DataBase
Notes: AccessiV.b is a variant of AccessiV (See AccessiV.a for more info). There are two main
differences between them.
The AccessiV.b searches and infects databases in the CURRENT, PARENT and ROOT
directories of current DRIVE.
The virus has a payload. Some claim that the virus activates in March, while others claim that is
activated on the 3rd day of every month. So, be aware of these dates.
When an infected database is opened, the virus replicates first, then displays a message-box, which
contains text strings and 3 buttons. The text string is as follows:
{ I am the AccessiV virus, strain B
Written by Jerk1N, of the DIFFUSION Virus Team
AccessiV was/is the first ever Access Virus!!! }
The buttons are ‘Abort’, ‘Retry’, and ‘Ignore’. When clicking any button, the virus tries to infect
the system by a DOS COM virus called Jerkin.443. Fortunately, it fails in dropping the COM
virus, because a bug exists in the viral code and an error message is displayed.
Name: Detox
Aliases: Detox, TOX, Macro.Aceess.Detox Type: Macro.
Disk Location: Program overlay files. Features: Deletes or moves files.
Damage: Deletes or moves
files.
Interferes with a running
application.
Interferes with a running application.
Size: Adds Macros to See Also:
DataBase
Notes: The Detox or TOX is the third micro virus that was discovered in April 1998. This virus
is designed to infect Access Database, which is part of the Office95 & Office97 package.
Detox consists of a script called ‘AutoExec’ and a module called ‘TDU’. The TDU module/macro
contains four functions (subroutines) and they are TheDetoxUnit, SetStartupProperties,
ChangeProperty, and Info.
While infecting, the virus replaces the original ‘AutoExec’ scripts by viral ‘AutoExec’ script, and
then it copies ‘TDU’ module/macro to the database
When an infected database files is opened, the ‘AutoExec’ script immediately calls TheDetoxUnit
function. This function searches the CURRENT DRIVE for new victims using ‘*.MDB’ mask.
Before infecting a database, Detox disables, alters, and changes several system parameters. The
virus disables the Options submenu from Tools menu. The virus changes several Access
Properties including AllowSpecialKeys, AllowBreakIntoCode and AllowBypassKey. The
ShowHiddenObjects is disabled, too.
The Info subroutine contains nothing except the following comments:
{ The Detox Unit Access Macro Virus
written by Sin Code IV
(an old friend by any other name...) }
14 CIAC Computer Virus Information Update May 21, 1998