Path: csiph.com!weretis.net!feeder4.news.weretis.net!feeder5.news.weretis.net!news.solani.org!.POSTED!not-for-mail
From: Thomas 'PointedEars' Lahn <PointedEars@web.de>
Newsgroups: comp.lang.javascript
Subject: Re: This is a VIRUS - how does it works?
Date: Fri, 14 Apr 2017 22:10:28 +0200
Organization: PointedEars Software (PES)
Lines: 27
Message-ID: <5261306.lOV4Wx5bFT@PointedEars.de>
References: <qtupdcda9p594dvj6aos78nhg4kp2b493f@4ax.com> <obpbrk$d0i$1@news.albasani.net> <2860008.aeNJFYEL58@PointedEars.de> <obqt2t$9a5$1@news.albasani.net>
Reply-To: Thomas 'PointedEars' Lahn <cljs@PointedEars.de>
Mime-Version: 1.0
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 8Bit
X-Trace: solani.org 1492200628 11577 eJwNx8EBADEEBMCWEMspB6H/EnLzGxxja1eDKRY7qIqbrq1QJM3VOPKfKYXFubiHqHeHvpD7AB98ERg= (14 Apr 2017 20:10:28 GMT)
X-Complaints-To: abuse@news.solani.org
NNTP-Posting-Date: Fri, 14 Apr 2017 20:10:28 +0000 (UTC)
User-Agent: KNode/4.14.2
X-Face: %i>XG-yXR'\"2P/C_aO%~;2o~?g0pPKmbOw^=NT`tprDEf++D.m7"}HW6.#=U:?2GGctkL,f89@H46O$ASoW&?s}.k+&.<b';Md8`dH6iqhT)6C^.Px|[=M@7=Ik[_w<%n1Up"LPQNu2m8|L!/3iby{-]A+#YE}Kl{Cw$\U!kD%K}\2jz"QQP6Uqr],./"?;=4v
X-User-ID: eJwFwYEBACAEBMCV+vA0Dsr+I3RnQrBdaVQbG6rQt+rGdHht3KCslXP6ogd5AqB4NTFFYdDz+qvUeRX6AS8bFTc=
Face: iVBORw0KGgoAAAANSUhEUgAAADAAAAAwBAMAAAClLOS0AAAAGFBMVEXTxa4RFk5dUWANED8PFEfy7+MGBiW+n3ZNF/QuAAACaElEQVQ4jVXUwVOcMBQG8Dc7Rc4PUntdWV2uxjDpGaGeozOp1woar4jd5t/v9wLstMwsA/ntlxdCAgUc1hjTc9/JCZfGoo3wG3HdmdAWrIJRHe7GM/TmpY5VFefuVcAkkPbLIaN8rmPmjloyZxgyR3GuJ4K0AGtJ2htz8o7yqikm759fldQXaMpbDzjKAG+8v+AugVTOPO5DOjLvGtUYQwh0CPjnVMyGd+8/GfUB5nLKJDD2aLDh5HYyMDJGDwQIo2ZmZcKbowNmAdB/AzyFhrmF2MHRb0QJJfaAnwGB6orZhoykLzJtGwF/xpYxI1dswomiUj3gTuAIqCn/4C7cULwGNBtwMTk3Y4LfKB5YUaOKBKYtpplm7u0vip8tU1NWWyI/7XdcSuIDoMt6rVHMWT0DbjHPGqDqZVSa6zleLcUTcIKLoMv3ueJluALtAo9B302zPPlrtiVScRdCjXvVh3e3JpYa/jjkuC9N+LrBMlz/eAN4eQijX2EdLo6c5tGGHwLyHFtXk89dDGHwCVhG9T0S/j55AhRZgkMCmUQXJ49TnS1wnQDvw0eAh9ICeMmEFbCnPMFzjAvsWoEWEFdYEx+S0MoUZ1gT1wId8+AF3Bl2OoEu906AUHx5VLw/gXYg/x84loOah/2UYNrgiwSwGO7RfUzVBbx/kgpckumGOi6QirtD6gkLTitbnxNol47S2jVc2vsN5kPqaAHT8uUdAJM4v/DanjYOwmUjWznGfwB7sGtAtor5BgofDuzaRj4kSQAqDakTsKORa3Q3xKi3gE1fhl71KRMqrdZ2AWNNg/YOhQyrVBnb+i+nEg4bsDA+egAAAABJRU5ErkJggg==
X-NNTP-Posting-Host: eJwFwQkBwDAIA0BLvEknZxTwL6F36VBcBhKRm1ut5V9PiwqmGaPkpI9s2cZa/KeOFam3QDwrahFg
Cancel-Lock: sha1:v28bybu8yGwhAclvPaOI+MvVr2U=
Xref: csiph.com comp.lang.javascript:33007

Stefan Weiss wrote:

> Tom, if you have a file named "uoaeeefxoexf" + digits + ".exe" in a temp
> file directory [1], […]
> [1]
> I'm not familiar enough with Win10 to know which directory
> GetSpecialFolder(2) from "Scripting.FileSystemObject" would return on a
> standard installation.

Given <https://msdn.microsoft.com/en-us/library/a72y2t1c(v=vs.84).aspx>,

  echo "$TMP"

would output it in a POSIX-compliant shell.

[IE 11 on Windows 10 on BrowserStack did not execute

   new ActiveXObject("Scripting.FileSystemObject")

In theory, there is <https://github.com/xdissent/ievms>, but VirtualBox is 
currently not compatible with my system.]

-- 
PointedEars
FAQ: <http://PointedEars.de/faq> | <http://PointedEars.de/es-matrix>
<https://github.com/PointedEars> | <http://PointedEars.de/wsvn/>
Twitter: @PointedEars2 | Please do not cc me./Bitte keine Kopien per E-Mail.