Why Access Macro Viruses Will Never Become A Problem.
By VicodinES /CB /TNN

It was only a few months ago that Jerk1N brought us the first ever Access macro virus. This was a huge accomplishment. Jerk1N was able to embarrass Microsoft and blaze a new trail for macro viruses, he deserves much credit for it. The idea itself and then making it happen was a great feat.

How prevalent will Access macro viruses become? Will everyone become "virus shy" every time they open a .mdb file? Nope. There will never be an Access virus epidemic.

How can I be so sure? First let me tell you my credentials. I wrote the second Access virus ever, Detox and I wrote the first ever cross-application macro virus, Cross.Poppy, that infected both Word 97 and Access 97. It wasn't possible to write code that would work 100% in both Access and Word so Cross.Poppy basically *jumped* from application to application. For all intensive purposes it is a cross-application virus. Now that have I have told you what I have done with Access macros you should be able to trust what I am about to tell you.

Access viruses will NEVER become a real problem for many reasons. The main one is that very few people share Access databases. Most of the time a database is created, updated and stored in one location. Very rarely will someone send you an Access database so even if you had an infected database it would have almost no chance of finding another mdb to infect.

Another problem is that there is no way for an Access virus to become resident in a default template. In Word macro viruses reside in the normal.dot and in Excel macro viruses reside in the personal.xls (or the startup directory). Becoming resident in a default template is what has made the Excel and Word macro viruses so successful. Access has no normal template for a virus to attach to and it does not load anything from a starup directory. There are Access database wizards from which new databases can be generated but these are mde files not mdb's and mde files are locked. A locked mde can not be infected. It may be possible to convert a mde to mdb, infect it and then convert it back but the only method I have seen that *attempts* to do this 1) didn't work correctly 2) was VERY noticeable.

Since there is no way for an Access virus to become resident it must seek-and-infect new files. This direct action would not be a problem if it was looking for common files but how many mdb files do you have on your hd? Not many I assure you - even if you do use Access. So a *good* Access virus must find something to infect and that could mean searching the ENTIRE hd. Do you think you would notice that it took 2 full minutes for your database to open each time you wanted to use it? Yes I think you would, unless you were an idiot.

As time passes and the "Access Virus Hysteria" passes you will see AVP and others add new Access viruses to their virus lists but I would bet my life you will never see an Access virus on the wild list Also I am reasonably sure that AV companies will receive less than a handful of Access virus reports - and you can bet that most of these will be from the Access virus authors themselves.

So give up on Access viruses? Sure, unless you just want to see how it's done for the experience but take it from me you wont be impressed. An Access virus could be written in as few as 10 lines. It's basically :

    		Get AutoOpen Control
    		Search For *.mdb
    		Transfer code if any are found
    		Quit

That's it. It's that easy. Doing it the first virus ever was the hard part (props to Jerk1N for that!) but there isn't much else to do with it. Even my Cross.Poppy virus will have a hard time finding some mdb's to infect. I wrote it only to search the c:\my documents directory. Why? Because I had no idea where someone would keep an Access database. I don't use Access, I only loaded Access to write a virus :-)

Peace, VicodinES

Facts:

1. AccessiV was the first ever Access macro virus (written by Jerk1N)
2. Detox was written by me to see if I could do one better.
3. I wrote Detox under the name "Sin Code IV"
4. Cross.Poppy was the first every cross-application macro virus but
5. Strange Days by Reptile/29A is the first true Office 97 macro virus and is a great piece of code!