Virus Database

Macro.AccessiV

Description Macro.AccessiV

This is the first known macro-virus that infects MS Access databases. The virus replaces the Autoexec script in databases ("macro" in Access terms), and copies additional macros ("module" in Access terms) to database. In this virus, the macro is named "Virus".
When an infected database is opened, the Autoexec script is activated. In infected databases, it immediately calls the virus function named "AccessiV" that searches for all databases in the current directory and infects them. While searching, the virus uses the "*.MDB" mask.
The virus does not manifest itself in any other way. It contains the comments:
Find MS Database File!
Find another MS Database File!

AccessiV.b
This is the second known Access macro-virus, which is very closely related to the first one. In March, this virus displays the MessageBox:
AccessiV - Strain B
I am the AccessiV virus, Strain B
Written by Jerk1N, of the DIFFUSION Virus Team
AccessiV was/is the first ever Access Virus!!!

It then creates and executes a file infected by DOS COM virus "Jerkin.443".

Check other viruses! Be aware! Use Antiviral Software

Macro.Word.Daniel.a

Description Macro.Word.Daniel.a

This is an encrypted macro-virus. It contains two macros:
NORMAL.DOT Infected files
MacroManager MacroManager
Word6Menu AutoOpen

When the system opens an infected file, the virus takes control and copies its macros to the global macros area. To get a control the virus not only uses its AutoOpen macro, but also sets its macro "MacroManager" as executed on File/Save command and on Ctrl-S and Ctrl-B keys. When that macro is executed, the virus infects current document.
To hide itself in system the virus removes the menu items that access macros. While infecting a document the virus sets new file summary info fields:
Keywords = "Daniel_Stone"
Comments = "All information should be free."

The virus contains remarked texts:
You've reached! Here is the virus. Enjoy.
This is the Word_Macro_Virus_Daniel_1F - Beta International Version.
Please Support the Virus Concept. Have a nice Day! (BR/US)

Macro.Word.DarkSide

Description Macro.Word.DarkSide

This is not a dangerous encrypted Word macro virus. It is related to the "MDMA" virus. It contains four macros: AutoClose, DarkSide1, HerramMacro, ToolsMacro. It infects the documents and the global macros area on AutoClose call.
The virus disables Tools/Macro menu (Herram/Macro in Spanish). It creates on disks the DARKSIDE.1 files and writes the texts to there:
ATENCION: esta computadora ha sido infectada!. DarkSide1 sin una
computadora es como Billy The Kid sin un revolver! ! . . . Virus DarkSide1
creado en la ciudad de Lima en enero de 1997 -=] DarkSide1 Is a peruvian
virus writer [=-

The virus also contains the REMarked comments:
DarkSide1 is in the wild!!! :-)
DarkSide1's E-Mail: virology@usa.net
DarkSide1's live in Peru!!

Macro.Word.DarkSide.b
This encrypted virus contains three macros: AutoClose, DarkSide1B, HerramMacro. It creates the DARKSIDE.NEW file in current directory on C: drive and writes the text to there:
DarkSide1 is Back!!
The name of this macrovirus is DarkSide1.B
Caro's name Dark.A ?! Caro Sucks!! :)
And rememberall DarkSide1 whitout a computer is like...
Billy the Kid without a gun!! :)
WM.DarkSide1.B] by DarkSide1 in Lima Peru 1997

The HerramMacro macro contain the texts:
it's only a clean macro :) very easy !!
DarkSide1 is Cool Macro Virus Writer :)
I like the macrovirii scene...rocks!! :)

Home