F-Secure Virus Descriptions : TOX

NAME:	TOX
ALIAS:	Detox

Detox is the third known macro virus to infect Access databases. This virus infects all database files all directories on the same drive as the virus.

Detox consists of a module called TDU and has a macro called Autoexec. Autoexec is automatically executed when an infected MDB file is opened. This virus can not be stopped by holding the shift key while opening the database. This is because the virus changes Access Properties incuding AllowSpecialKeys, AllowBreakIntoCode and AllowBypassKey respectively.

The virus does not activate in anyway but it does contain these comments:

        The Detox Unit Access Macro Virus
        written by Sin Code IV
        (an old friend by any other name...)

Since the virus turns off the Show Hidden Objects flag and deletes the Tools/Options menu, the macro code can not be easily viewed. This can be bypassed by choosing View/Toolbar/Customize Reset command. When doing this, the an infected database should be kept open - otherwise the virus in Autoexec macro would delete the Tools menu again.

[Analysis: Peter Szor, F-Secure, 1998]