Eng
  1. Skip to navigation
  2. Skip to content
  3. Skip to sidebar


TOX


Aliases:


Detox

Malware
Virus
W97M

Summary

Detox is the third known macro virus to infect Access databases. This virus infects all database files all directories on the same drive as the virus.



Disinfection & Removal

Automatic Disinfection

Allow F-Secure Anti-Virus to disinfect the relevant files.

For more general information on disinfection, please see Removal Instructions.



Technical Details

Detox consists of a module called TDU and has a macro called Autoexec. Autoexec is automatically executed when an infected MDB file is opened. This virus can not be stopped by holding the shift key while opening the database. This is because the virus changes Access Properties incuding AllowSpecialKeys, AllowBreakIntoCode and AllowBypassKey respectively.

The virus does not activate in anyway but it does contain these comments:

The Detox Unit Access Macro Virus
        written by Sin Code IV
        (an old friend by any other name...)

Since the virus turns off the Show Hidden Objects flag and deletes the Tools/Options menu, the macro code can not be easily viewed. This can be bypassed by choosing View/Toolbar/Customize Reset command. When doing this, the an infected database should be kept open - otherwise the virus in Autoexec macro would delete the Tools menu again.





Technical Details: Peter Szor, F-Secure, 1998



Submit a sample




Wondering if a file or URL is malicious? Submit a sample to our Lab for analysis via the Sample Analysis System (SAS)

Give And Get Advice




Give advice. Get advice. Share the knowledge on our free discussion forum.