Summary

A97M/Walla infects MS Access databases. While infecting the virus replaces in databases the Autoexec script and copies to database additional form named "Walla Walla". Form contains macro with two subroutines:

        Form_Load
        ChangeProperty

Additional Details

When an infected database is opened, the startup form is activated. In infected databases it immediately calls subroutine "Load_Form" that contains main virus code. This subroutine searches for first five databases in the current directory and infects them. While searching the virus uses the "*.MDB" mask. Before infecting the virus changes several system parameters: disables viewing macros by using hot-keys and on error while executing macros, enables executing auto-scripts when Shift key is pressed (by default pressed Shift disables auto-scripts).

If day of month equals the month number, the virus shows two messages:

        Walla Walla

        Walla Walla...
        You've gotten off easy so many times
        But I guess no one told you how to get a life

and

        A97M/Walla Walla

        Walla Walla...
        The Song by The Offspring (c) 1998
        The Virus by RUiNER '98 (c) 1998

[Analysis: Eugene Kaspersky]