Threat Description

TOX

Details

Aliases: Detox
Category: Malware
Type: Virus
Platform: W97M

Summary



Detox is the third known macro virus to infect Access databases. This virus infects all database files all directories on the same drive as the virus.



Removal



Automatic Disinfection

Allow F-Secure Anti-Virus to disinfect the relevant files.

For more general information on disinfection, please see Removal Instructions.



Technical Details



Detox consists of a module called TDU and has a macro called Autoexec. Autoexec is automatically executed when an infected MDB file is opened. This virus can not be stopped by holding the shift key while opening the database. This is because the virus changes Access Properties incuding AllowSpecialKeys, AllowBreakIntoCode and AllowBypassKey respectively.

The virus does not activate in anyway but it does contain these comments:

The Detox Unit Access Macro Virus
        written by Sin Code IV
        (an old friend by any other name...)

Since the virus turns off the Show Hidden Objects flag and deletes the Tools/Options menu, the macro code can not be easily viewed. This can be bypassed by choosing View/Toolbar/Customize Reset command. When doing this, the an infected database should be kept open - otherwise the virus in Autoexec macro would delete the Tools menu again.





Technical Details: Peter Szor, F-Secure, 1998


SUBMIT A SAMPLE

Suspect a file or URL was wrongly detected? Submit a sample to our Labs for analysis

Submit Now

Give And Get Advice

Give advice. Get advice. Share the knowledge on our free discussion forum.

Learn More