I need to say this, first, just in case my co-workers are lurking here.
I would NEVER timebomb a workbook that others are depending on.
Demo versions? Nobody should be depending on a demo version. Timebomb away. Microsoft does it with their demos. Why not others?
Well, whatever you do, it shouldn't flag on virus scanners. Test your code on an up-to-date scanner, to make sure it doesn't flag.
I think anything that deletes/modifies code will flag a scanner, and most definitely it will flag in Excel XP 2002.
I would think the code for a conventional "timebomb" goes like this:
Save the date of initial run/date of disablement, perhaps in an outermost cell of each worksheet. Restrict the ScrollArea of all sheets, have the value in "white ink".
Test for the value, or a combination of values. A CRC check sounds appropriate.
As long as the value(s) are good, then run the workbook.
If the values are corrupted/CRC doesn't come back good, then pop-up a "Goodbye" message, close the workbook.
I would also change all the variable/Routine names to two letter variables. "AA" to "ZZ" would give 600 + names.