Macro.Word97.Rsm
Description Macro.Word97.Rsm
This is a Word97 macro virus, it contains one macro: AutoOpen. It is a "non-memory resident" virus - on opening an infected file, it searches for non-infected documents in directories (from current to root) and infects them. To detect already infected documents, the virus writes its ID-stamp to a not used field in the document's header.
Depending on the system random counter, the virus displays the MessageBoxes:
bwahah !!!
RatSMagic by Reptile
Check other viruses! Be aware! Use Antiviral Software
Macro.Access.Detox.a
Description Macro.Access.Detox.a
This virus infects MS Access databases. While infecting, the virus replaces the Autoexec script in databases and copies an additional macro named TDU to the database . This macro contains four subroutines:
TheDetoxUnit
SetStartupProperties
ChangeProperty
Info
When an infected database is opened, the Autoexec macro is activated. In infected databases it immediately calls the virus function TheDetoxUnit that searches for all databases in the current directory and infects them. While searching the virus uses the "*.MDB" mask. Before infecting the virus disables the Tools/Options menu and changes several system parameters: disables viewing macros by using hot-keys and on error while executing macros, enables executing auto-scripts when Shift key is pressed (by default pressed Shift disables auto-scripts).
The Info subroutine contains nothing but comments:
The Detox Unit Access Macro Virus
written by Sin Code IV
(an old friend by any other nameall)
Macro.Access.Lovely
Description Macro.Access.Lovely
This virus infects MS Access databases. While infecting the virus replaces in databases the Autoexec script and copies to database additional form named "Jo". This form contains a module with one function "Jg".
When infected database is opened the virus searches for all databases in the current directory and infects them. While searching the virus uses the "*.MDB" mask.
Before infecting the virus changes several system parameters: disables viewing macros by using hot-keys and on error while executing macros. The virus does not have any payload procedure.
The virus contains the "copyright" text:
Copyright (C) 1998 by FlyShadow ~^^~ - Lovely
|