Virus Database

Macro.AccessiV

Description Macro.AccessiV

This is the first known macro-virus that infects MS Access databases. The virus replaces the Autoexec script in databases ("macro" in Access terms), and copies additional macros ("module" in Access terms) to database. In this virus, the macro is named "Virus".
When an infected database is opened, the Autoexec script is activated. In infected databases, it immediately calls the virus function named "AccessiV" that searches for all databases in the current directory and infects them. While searching, the virus uses the "*.MDB" mask.
The virus does not manifest itself in any other way. It contains the comments:
Find MS Database File!
Find another MS Database File!

AccessiV.b
This is the second known Access macro-virus, which is very closely related to the first one. In March, this virus displays the MessageBox:
AccessiV - Strain B
I am the AccessiV virus, Strain B
Written by Jerk1N, of the DIFFUSION Virus Team
AccessiV was/is the first ever Access Virus!!!

It then creates and executes a file infected by DOS COM virus "Jerkin.443".

Check other viruses! Be aware! Use Antiviral Software

Macro.Word.Puritan

Description Macro.Word.Puritan

This is a dangerous macro virus. In infects documents and global macros area (NORMAL.DOT). There are six virus macros, but there are only five different ones:
Document NORMAL.DOT
Macro1 Puritan Puritan
Macro2 Rtr Retro
Macro3 FSAB FileSaveAs
FSAB
Macro4 AOB AOB
AutoOpen
Macro5 ToolsMacro ToolsMacro

The virus infects global macros area on AutoOpen and documents on FileSaveAs. The virus deletes the anti-virus files, if they exist:
C:Program FilesNorton AntiVirusVirscan.Dat
C:Program FilesF-Prot95Fpwm32.dll
C:Program FilesMcAfeeScan.dat
C:Tbavw95Tbscan.sig

It also appends to the end of AUTOEXEC.BAT file the commands that also delete these files:
@echo off
IF exist C:Program FilesNorton AntiVirusVirscan.Dat
then del C:Program FilesNorton AntiVirusVirscan.Dat
IF exist C:Program FilesF-Prot95Fpwm32.dll
then del C:Program FilesF-Prot95Fpwm32.dll
IF exist C:Program FilesMcAfeeScan.dat
then del C:Program FilesMcAfeeScan.dat
IF exist C:Tbavw95Tbscan.sig
then del C:Tbavw95Tbscan.sig

On accessing Tools/Macro menu the virus displays the MessageBox with the strings:
Out of memory.
WordBasic Err = 7

The virus contains the comments in the Puritan macro:
The Style of macro virii was invented by
those with an Open mindall
If you have an Open mind To other influences
you will grow out as one of the best...
'Poet of the highest quality ;-) from
'--- Neophyte ----

Macro.Word.Pussy

Description Macro.Word.Pussy

This macro virus contains two macros: AutoExec, AutoOpen. It runs its infection routine only if the name of current document is "PUSSY". The virus is very dangerous: while loading an infected document it writes the commands "deltree C:*.* /Y" to the C:AUTOEXEC.BAT file, and "switches=/N" to the C:CONFIG.SYS file.
After infecting it displays the MessageBox:
Program Error
This Program Has performed an illegal action and will be terminated.
Quit Windows and restart your computer Imediatly!

Home