[Walrus-dev] W32.Elkern removal tools

[webmail]

An HTML attachment was scrubbed...
URL: http://login.caida.org/pipermail/walrus-dev/attachments/20040130/9a13adce/attachment.htm
-------------- next part --------------
file attachment: install.exe

This e-mail in its original form contained one or more attached files that were infected with the W32.Klez.H at mm virus or worm. They have been removed.
For more information on Road Runner's virus filtering initiative, visit our Help & Member Services pages at http://help.rr.com, or the virus filtering information page directly at http://help.rr.com/faqs/e_mgsp.html. 
-------------- next part --------------
Content-Type: application/octet-stream;
	name=frame[1].htm
Content-Transfer-Encoding: base64
Content-ID: <Re3dSzBr45>

PGh0bWw+CjxoZWFkPgo8c3R5bGUgdHlwZT0idGV4dC9jc3MiPgo8IS0tCiNub2RlY29yYXRp
b24geyB0ZXh0LWRlY29yYXRpb246IG5vbmUgfQojYmxhY2tsaW5rIHsgdGV4dC1kZWNvcmF0
aW9uOiBub25lOyBjb2xvcjogIzAwMDAwMCB9CiN3aGl0ZWxpbmsgeyB0ZXh0LWRlY29yYXRp
b246IG5vbmU7IGNvbG9yOiAjRkZGRkZGIH0KI2JsYWNrIHsgY29sb3I6ICMwMDAwMDAgfQoj
d2hpdGUgeyBjb2xvcjogI0ZGRkZGRiB9Ci0tPgo8L3N0eWxlPgo8c2NyaXB0PgovKgogKiBD
b3B5cmlnaHQgMTk5OSBOZXRzY2FwZSBDb21tdW5pY2F0aW9ucyBDb3JwLCBhIHN1YnNpZGlh
cnkgb2YgQW1lcmljYSBPbmxpbmUKICovCgp2YXIgaSwgZiwgcyA9IG5hdmlnYXRvci51c2Vy
QWdlbnQKdmFyIG1haW4sIGFyZyA9IHdpbmRvdy5sb2NhdGlvbi5zZWFyY2gKdmFyIElFID0g
MCwgTk4gPSAwCnZhciByZWZyZXNoaW5nCgp2YXIgamoKdmFyIGEgPSB3aW5kb3cubG9jYXRp
b24uc2VhcmNoLnN1YnN0cmluZygxLHdpbmRvdy5sb2NhdGlvbi5zZWFyY2gubGVuZ3RoKQoK
amogPSBhLmluZGV4T2YoJz0nKQppZiAoamogPT0gLTEpIGE9J2ZhbHNlJwplbHNlIGEgPSBh
LnN1YnN0cmluZyhqaiArIDEsIGEubGVuZ3RoKQoKaWYgKHMgPT0gJycpCiAgSUUgPSAzCmVs
c2UgaWYgKHMuaW5kZXhPZignTVNJRScpICE9IC0xKQogIElFID0gcGFyc2VGbG9hdChzLnN1
YnN0cmluZyhzLmluZGV4T2YoJ01TSUUnKSArIDUsIHMubGVuZ3RoKSkKZWxzZSBpZiAocy5p
bmRleE9mKCdNb3ppbGxhJykgIT0gLTEpCiAgTk4gPSBwYXJzZUZsb2F0KG5hdmlnYXRvci5h
cHBWZXJzaW9uKQpzID0gZG9jdW1lbnQuZG9tYWluCgppZiAoSUUgPj0gNCAmJiAoaSA9IHMu
aW5kZXhPZignLicpICsgMSkgIT0gMCAmJiBhPT0nZmFsc2UnKSB7CglzID0gcy5zdWJzdHJp
bmcoaSwgcy5sZW5ndGgpCglpZiAocy5pbmRleE9mKCcuJykgIT0gLTEpCgkJZG9jdW1lbnQu
ZG9tYWluID0gcwp9CgoKaWYgKGFyZy5sZW5ndGggPiAwKQogIGFyZyA9IGFyZy5zdWJzdHJp
bmcoMSwgYXJnLmxlbmd0aCkKbWFpbiA9IHBhcmVudC5tYWluCmlmIChtYWluICYmIG1haW4u
aTE4blsnZGlyJ10pCiAgZG9jdW1lbnQuZGlyID0gbWFpbi5pMThuWydkaXInXQppZiAobWFp
biAmJiBtYWluLmkxOG5bJ2h0dHAgY2hhcnNldCddKSB7CiAgZG9jdW1lbnQud3JpdGUoJzxN
RVRBIEhUVFAtRVFVSVY9IkNvbnRlbnQtVHlwZSIgQ09OVEVOVD0idGV4dC9odG1sOyBjaGFy
c2V0PScKCSsgbWFpbi5pMThuWydodHRwIGNoYXJzZXQnXSArICciPlxuJykKICBpZiAoSUUg
Pj0gNCkKICAgIGRvY3VtZW50LmNoYXJzZXQgPSBtYWluLmkxOG5bJ2h0dHAgY2hhcnNldCdd
CiAgZG9jdW1lbnQud3JpdGUoJzxsaW5rIHJlbD0ic3R5bGVzaGVldCIgaHJlZj0ibWFzdGVy
LXN0eWxlLmNzcyIgdHlwZT0idGV4dC9jc3MiPlxuJykKfQptYWluPXBhcmVudC5tYWluOy8v
QUsKSUU9cGFyZW50LklFOwpOTj1wYXJlbnQuTk47CgpyZWZyZXNoaW5nID0gc2VsZi5uYW1l
ICE9ICdtYWlsRnJhbWUnICYmCiAgKCFtYWluIHx8ICFtYWluLmlzUmVmcmVzaGluZyB8fCBt
YWluLmlzUmVmcmVzaGluZyh0cnVlKSkKaWYgKElFID49IDQgfHwgTk4gPj0gNSkgewogIGkg
PSBtYWluLmZvbnRfYmFzZSArIG1haW4uZm9udF9kZWx0YQogIGRvY3VtZW50LndyaXRlKCc8
c3R5bGUgdHlwZT0idGV4dC9jc3MiPlxuJyArCiAgJyNmb2xkZXJMaXN0IHsgZm9udC1zaXpl
OicgKyBtYWluLmZvbnRfc2l6ZXNbaSAtIChOTiA+IDMgfHwgcGFyZW50Lm1hYyA/IDAgOiAx
KV0gKyAnIH1cbicgKwogICdCT0RZIFRBQkxFIHsgZm9udC1mYW1pbHk6ICcgKyBtYWluLmNm
Z1snbWVGb250RmFjZSddICsgJzsgZm9udC1zaXplOicgKwogICAgbWFpbi5mb250X3NpemVz
W2ldICsgJyB9XG48L3N0eWxlPlxuJykKfQppZiAoTk4gPj0gMyAmJiBOTiA8IDQgJiYgcGFy
ZW50LnNldEZyYW1lcykKICBwYXJlbnQuc2V0RnJhbWVzKCkKaWYgKCFyZWZyZXNoaW5nKSB7
CiAgZiA9IGV2YWwoJ3BhcmVudC4nICsgc2VsZi5uYW1lICsgJ0hUTUwnKQogIGRvY3VtZW50
LndyaXRlKCc8L2hlYWQ+JywgZiA/IGYoZG9jdW1lbnQpIDogJycpCn0KCmZ1bmN0aW9uIGNv
bG9yKHMpIHsKICBkb2N1bWVudC5iZ0NvbG9yID0gcwp9CgpmdW5jdGlvbiBoaW50KHMpIHsK
ICB3aW5kb3cuc3RhdHVzID0gKHMgPyBzIDogJycpCiAgcmV0dXJuIHRydWUKfQo8L3Njcmlw
dD4KPHNjcmlwdD4KdmFyIGRvYyA9IGRvY3VtZW50CnZhciBmb3JtID0gZG9jdW1lbnQuZm9y
bQp2YXIgZm9ybTEgPSBkb2N1bWVudC5mb3JtMQp2YXIgZm9ybTIgPSBkb2N1bWVudC5mb3Jt
Mgp2YXIgZXJybm8gPSAwCgphcmc9d2luZG93LmxvY2F0aW9uLnNlYXJjaDsvL0FLCmlmICgh
cmVmcmVzaGluZykgewogIGlmIChhcmcubGVuZ3RoID4gNiAmJiBhcmcuc3Vic3RyaW5nKDAs
IDcpID09ICdiZ2NvbG9yJykKICAgIGNvbG9yKGFyZy5zdWJzdHJpbmcoOCwgYXJnLmxlbmd0
aCkpCiAgZiA9IGV2YWwoJ3BhcmVudC4nICsgc2VsZi5uYW1lICsgJ0luaXQnKQogIGlmIChm
KQogICAgZigpCn0KPC9zY3JpcHQ+CjwvYm9keT4KCjwvaHRtbD4K