Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.javascript > #32870 > unrolled thread

This is a VIRUS - how does it works?

Back to article view | Back to comp.lang.javascript

Contents

  This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-03-30 14:37 +0200
    Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-03-30 14:43 +0200
      Re: This is a VIRUS - how does it works? Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2017-03-30 18:32 +0200
    Re: This is a VIRUS - how does it works? Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2017-03-30 18:31 +0200
      Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-03-30 21:22 +0200
        Re: This is a VIRUS - how does it works? "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2017-03-30 23:20 +0200
          Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-03-31 14:00 +0200
            Re: This is a VIRUS - how does it works? "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2017-03-31 17:26 +0200
              Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-04-01 22:00 +0200
                Re: This is a VIRUS - how does it works? "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2017-04-01 22:11 +0200
                  Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-04-02 21:02 +0200
                    Re: This is a VIRUS - how does it works? "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2017-04-02 22:50 +0200
                      Re: This is a VIRUS - how does it works? a <a@inwind.it> - 2017-04-03 23:18 +0200
                        Re: This is a VIRUS - how does it works? "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2017-04-03 23:22 +0200
                          Re: This is a VIRUS - how does it works? Tim Streater <timstreater@greenbee.net> - 2017-04-03 22:41 +0100
                          Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-04-04 00:58 +0200
                            Re: This is a VIRUS - how does it works? "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2017-04-04 09:31 +0200
                              Re: This is a VIRUS - how does it works? Flippie Flink <flip@flink.not> - 2017-04-04 12:09 +0200
                        Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-04-04 00:50 +0200
        Re: This is a VIRUS - how does it works? Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2017-03-31 00:51 +0200
          Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-03-31 14:05 +0200
            Re: This is a VIRUS - how does it works? Wally W. <ww84wa@aim.com> - 2017-03-31 11:54 -0400
              Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-04-01 21:56 +0200
    Re: This is a VIRUS - how does it works? Stefan Weiss <krewecherl@gmail.com> - 2017-04-02 01:07 +0200
      Re: This is a VIRUS - how does it works? Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2017-04-02 14:31 +0200
        Re: This is a VIRUS - how does it works? Stefan Weiss <krewecherl@gmail.com> - 2017-04-02 15:07 +0200
          Re: This is a VIRUS - how does it works? Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2017-04-14 22:10 +0200
      Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-04-02 21:45 +0200
        Re: This is a VIRUS - how does it works? Stefan Weiss <krewecherl@gmail.com> - 2017-04-03 03:03 +0200
          Re: This is a VIRUS - how does it works? a <a@inwind.it> - 2017-04-04 00:45 +0200
            Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-04-04 00:50 +0200
            Re: This is a VIRUS - how does it works? Stefan Weiss <krewecherl@gmail.com> - 2017-04-04 02:51 +0200
              Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-04-06 23:54 +0200
                Re: This is a VIRUS - how does it works? "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2017-04-07 09:03 +0200
                  Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-04-07 23:05 +0200
                    Re: This is a VIRUS - how does it works? "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2017-04-07 23:48 +0200
                      Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-04-08 14:09 +0200
                        Re: This is a VIRUS - how does it works? "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2017-04-08 14:32 +0200
    Re: This is a VIRUS - how does it works? "Chris M. Thomasson" <invalid@invalid.invalid> - 2017-04-03 14:31 -0700
      Re: This is a VIRUS - how does it works? "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2017-04-03 23:34 +0200
        Re: This is a VIRUS - how does it works? Andrew Poulos <ap_prog@hotmail.com> - 2017-04-04 11:35 +1000
          Re: This is a VIRUS - how does it works? "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2017-04-04 09:36 +0200
      Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-04-04 00:59 +0200
        Re: This is a VIRUS - how does it works? "Chris M. Thomasson" <invalid@invalid.invalid> - 2017-04-03 16:08 -0700
          Re: This is a VIRUS - how does it works? "Chris M. Thomasson" <invalid@invalid.invalid> - 2017-04-03 16:17 -0700
          Re: This is a VIRUS - how does it works? "Chris M. Thomasson" <invalid@invalid.invalid> - 2017-04-05 13:58 -0700
        Re: This is a VIRUS - how does it works? "Chris M. Thomasson" <invalid@invalid.invalid> - 2017-04-19 12:59 -0700
          Re: This is a VIRUS - how does it works? "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2017-04-20 00:13 +0200
            Re: This is a VIRUS - how does it works? "Chris M. Thomasson" <invalid@invalid.invalid> - 2017-04-19 16:59 -0700
              Re: This is a VIRUS - how does it works? "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2017-04-20 08:49 +0200
                Re: This is a VIRUS - how does it works? "Chris M. Thomasson" <invalid@invalid.invalid> - 2017-05-01 13:40 -0700
    Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-04-12 14:06 +0200
      Re: This is a VIRUS - how does it works? <cyber@2trom.com> - 2017-04-12 13:59 +0000
        Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-04-12 22:23 +0200
          Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-04-12 22:28 +0200
          Re: This is a VIRUS - how does it works? <cyber@2trom.com> - 2017-04-12 21:55 +0000
          Re: This is a VIRUS - how does it works? "Michael Haufe (TNO)" <tno@thenewobjective.com> - 2017-04-14 12:34 -0700
            Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-04-14 22:42 +0200

Page 1 of 3  [1] 2 3  Next page →

#32870 — This is a VIRUS - how does it works?

Hallo,

i received an email from a fake DHL corrier (about a package delivering),
it had an attachment, 
the attachment was a "ST6890945.zip" file,
it contained a .jse file,
the file is "ST6890945.jse"

the body of the email invited me to open and read the attachment,
I extracted on the Desktop folder the .jse file
and I double-clicked the .jse file
on my Windows 10 64 bit 

What happened:
a black window shortly opened,
a hourglass appeared,
the black open window closed
the .jse delete himself
(in about three seconds)


I downloaded and run an antivirus (SpyHunter)
it found a 
- "wsKs.exe" file in "C:/Program Data" folder
- a Registry entry in "HKLM/..../run" called "Load" 
the "Load" entry was pointing to the "wsKs.exe" file
- a suspicious cookie (I dont'remeber its name)

I deleted all the three of them,
but I don't know if they had been created by this "ST6890945.jse" 
or if they were an old virus,
so the "ST6890945.jse" malicious injections could still be in my Windows
10...  

I downloaded and run another antivirus (Avast),
it didn't find anything


Note:
I double-clicked the same "ST6890945.jse" file
on an old Windows 98 machine for testing pourpose 
and I noted that the black shortly appeared windows was called IPConfig


I copy-paste here the script of the "ST6890945.jse" 


QUESTION:

is there anybody who is able to understand what it does
(and therefore what should have I delete more from my Windows 10 64
bit...)?


PAY ATTENTION:
In the following posts I'll send the .zip file containing the .jse file

[toc] | [next] | [standalone]

#32875

I sent the copy-pasted text,
in four parts, 
and not the .zip file containing the. jse file

[toc] | [prev] | [next] | [standalone]

#32882

tom wrote:

> I sent the copy-pasted text,
> in four parts,
> and not the .zip file containing the. jse file

Good.  Doing otherwise would have been your next (fifth or so) mistake,
as you could have helped to spread the virus among the more clueless
of Usenet users.

-- 
PointedEars
FAQ: <http://PointedEars.de/faq> | <http://PointedEars.de/es-matrix>
<https://github.com/PointedEars> | <http://PointedEars.de/wsvn/>
Twitter: @PointedEars2 | Please do not cc me./Bitte keine Kopien per E-Mail.

[toc] | [prev] | [next] | [standalone]

#32881

tom wrote:
^^^
Your real name belongs there, “tom” #74656.  Also, your sender address is 
invalid.

> i received an email from a fake DHL corrier (about a package delivering),
> it had an attachment,
> the attachment was a "ST6890945.zip" file,
> it contained a .jse file,
> the file is "ST6890945.jse"
> 
> the body of the email invited me to open and read the attachment,
> I extracted on the Desktop folder the .jse file
> and I double-clicked the .jse file

First mistake.  Never open suspicious e-mails.  Never open suspicious 
attachments directly.

> on my Windows 10 64 bit

Second mistake, see below.
 
> What happened:
> a black window shortly opened,
> a hourglass appeared,
> the black open window closed
> the .jse delete himself
> (in about three seconds)
> 
> 
> I downloaded and run an antivirus (SpyHunter)

Third mistake.  Once your system is compromised, no malicious software 
recognition tool in the world can 100 % undo that.

Also, SpyHunter is not an antivirus, it is a spyware removal tool.

> it found a
> - "wsKs.exe" file in "C:/Program Data" folder
> - a Registry entry in "HKLM/..../run" called "Load"
> the "Load" entry was pointing to the "wsKs.exe" file
> - a suspicious cookie (I dont'remeber its name)
> 
> I deleted all the three of them,

Fourth mistake.  Only reinstalling your system can make it clean again.  
Only if you really know what you are doing (and you clearly don’t), and the 
malicious software did not have privileged access, it may suffice to delete 
and recreate the affected user account.

> but I don't know if they had been created by this "ST6890945.jse"
> or if they were an old virus, so the "ST6890945.jse" malicious injections
> could still be in my Windows 10...

You better count on that.
 
> I downloaded and run another antivirus (Avast),
> it didn't find anything

That does not mean that your system is clean.  Antivirus software can only 
find malware that is recognizable as such; either clearly recognizable 
because of known patterns, or similar to known patterns as recognizable by 
heuristics.

> is there anybody who is able to understand what it does
> (and therefore what should have I delete more from my Windows 10 64
> bit...)?

Yes.  Delete everything of it.  Windows 10 is the biggest virus and spyware 
of all.

<http://www.networkworld.com/article/2956574/microsoft-subnet/windows-10-privacy-spyware-settings-user-agreement.html>

> PAY ATTENTION:
> In the following posts I'll send the .zip file containing the .jse file

You did not, and that is good so.  This is a non-binary newsgroup.

-- 
PointedEars
FAQ: <http://PointedEars.de/faq> | <http://PointedEars.de/es-matrix>
<https://github.com/PointedEars> | <http://PointedEars.de/wsvn/>
Twitter: @PointedEars2 | Please do not cc me./Bitte keine Kopien per E-Mail.

[toc] | [prev] | [next] | [standalone]

#32884

Are you able to read the script I posted and tell me what it does?

[toc] | [prev] | [next] | [standalone]

#32885

tom <tom@inwind.it> wrote on 30 Mar 2017 in comp.lang.javascript:

> Are you able to read the script I posted and tell me what it does?

Are you responding to someone in particular?

-- 
Evertjan.
The Netherlands.
(Please change the x'es to dots in my emailaddress)

[toc] | [prev] | [next] | [standalone]

#32889

On Thu, 30 Mar 2017 23:20:32 +0200, "Evertjan."
<exxjxw.hannivoort@inter.nl.net> wrote:

>tom <tom@inwind.it> wrote on 30 Mar 2017 in comp.lang.javascript:
>
>> Are you able to read the script I posted and tell me what it does?
>
>Are you responding to someone in particular?

to Thomas

the others can find my question in the first message

[toc] | [prev] | [next] | [standalone]

#32891

tom <tom@inwind.it> wrote on 31 Mar 2017 in comp.lang.javascript:

> On Thu, 30 Mar 2017 23:20:32 +0200, "Evertjan."
> <exxjxw.hannivoort@inter.nl.net> wrote:
> 
>>tom <tom@inwind.it> wrote on 30 Mar 2017 in comp.lang.javascript:
>>
>>> Are you able to read the script I posted and tell me what it does?
>>
>>Are you responding to someone in particular?
> 
> to Thomas

Which Thomas?
 
> the others can find my question in the first message

That is not the way it works on Usenet, where the postings are not in a 
strict order, but are dependent on the local News-server.

This is written in the Usenet-Netiquette.

Please read the Netiquette, then RTBF.

If you want to reply just to a specific person, please use email.


-- 
Evertjan.
The Netherlands.
(Please change the x'es to dots in my emailaddress)

[toc] | [prev] | [next] | [standalone]

#32899

On Fri, 31 Mar 2017 17:26:45 +0200, "Evertjan."
<exxjxw.hannivoort@inter.nl.net> wrote:

>> the others can find my question in the first message
>
>That is not the way it works on Usenet, where the postings are not in a 
>strict order, but are dependent on the local News-server.
>
>This is written in the Usenet-Netiquette.
>
>Please read the Netiquette, then RTBF.

I don't understand what you are saying:
I wanted to reply to Thomas' post and I did it, that's all.

[toc] | [prev] | [next] | [standalone]

#32900

tom <tom@inwind.it> wrote on 01 Apr 2017 in comp.lang.javascript:

> On Fri, 31 Mar 2017 17:26:45 +0200, "Evertjan."
> <exxjxw.hannivoort@inter.nl.net> wrote:
> 
>>> the others can find my question in the first message
>>
>>That is not the way it works on Usenet, where the postings are not in a 
>>strict order, but are dependent on the local News-server.
>>
>>This is written in the Usenet-Netiquette.
>>
>>Please read the Netiquette, then RTBF.
> 
> I don't understand what you are saying:

Read the Netiquette and then RTBF.

> I wanted to reply to Thomas' post and I did it, that's all.

Well, this is Usenet, you can do what you want, but if you do not do it 
according to the Netiquette, well ...

In a NG, you respond to the group, it is not the place for private mail.

-- 
Evertjan.
The Netherlands.
(Please change the x'es to dots in my emailaddress)

[toc] | [prev] | [next] | [standalone]

#32907

On Sat, 01 Apr 2017 22:11:34 +0200, "Evertjan."
<exxjxw.hannivoort@inter.nl.net> wrote:

>tom <tom@inwind.it> wrote on 01 Apr 2017 in comp.lang.javascript:
>
>> On Fri, 31 Mar 2017 17:26:45 +0200, "Evertjan."
>> <exxjxw.hannivoort@inter.nl.net> wrote:
>> 
>>>> the others can find my question in the first message
>>>
>>>That is not the way it works on Usenet, where the postings are not in a 
>>>strict order, but are dependent on the local News-server.
>>>
>>>This is written in the Usenet-Netiquette.
>>>
>>>Please read the Netiquette, then RTBF.
>> 
>> I don't understand what you are saying:
>
>Read the Netiquette and then RTBF.
>
>> I wanted to reply to Thomas' post and I did it, that's all.
>
>Well, this is Usenet, you can do what you want, but if you do not do it 
>according to the Netiquette, well ...
>
>In a NG, you respond to the group, it is not the place for private mail.

I replied to Thomas as you replied to me.

[toc] | [prev] | [next] | [standalone]

#32909

tom <tom@inwind.it> wrote on 02 Apr 2017 in comp.lang.javascript:

> On Sat, 01 Apr 2017 22:11:34 +0200, "Evertjan."
> <exxjxw.hannivoort@inter.nl.net> wrote:
> 
[..]
>>In a NG, you respond to the group, it is not the place for private mail.
> 
> I replied to Thomas as you replied to me.

No, I relpied to the group, quoting the relevant text.

You did not quote, so what you meant was just a guess to the group.

Please RTBN and RTBF.

-- 
Evertjan.
The Netherlands.
(Please change the x'es to dots in my emailaddress)

[toc] | [prev] | [next] | [standalone]

#32913

On Sun, 02 Apr 2017 22:50:03 +0200, "Evertjan."
<exxjxw.hannivoort@inter.nl.net> wrote:

>tom <tom@inwind.it> wrote on 02 Apr 2017 in comp.lang.javascript:
>
>> On Sat, 01 Apr 2017 22:11:34 +0200, "Evertjan."
>> <exxjxw.hannivoort@inter.nl.net> wrote:
>> 
>[..]
>>>In a NG, you respond to the group, it is not the place for private mail.
>> 
>> I replied to Thomas as you replied to me.
>
>No, I relpied to the group, quoting the relevant text.
>
>You did not quote, so what you meant was just a guess to the group.
>
>Please RTBN and RTBF.


but 
I had nothing to quote in Thomas post
(and I had to post a general reply (a sort of remind) to Thomas' post
instead)
 

[toc] | [prev] | [next] | [standalone]

#32914

a <a@inwind.it> wrote on 03 Apr 2017 in comp.lang.javascript:

>>Please RTBN and RTBF.
> 
> 
> but 
> I had nothing to quote in Thomas post
> (and I had to post a general reply (a sort of remind) to Thomas' post
> instead)

So you had to quote relevant part, meaning that you had to show on what 
posting you responded.

How were we to know which Thomas you were responding on?

Please RTBN and RTBF.

-- 
Evertjan.
The Netherlands.
(Please change the x'es to dots in my emailaddress)

[toc] | [prev] | [next] | [standalone]

#32917

In article <XnsA74CEDC2CCE96eejj99@194.109.6.166>, Evertjan.
<exxjxw.hannivoort@inter.nl.net> wrote:

>a <a@inwind.it> wrote on 03 Apr 2017 in comp.lang.javascript:
>
>>>Please RTBN and RTBF.
>> 
>> 
>> but 
>> I had nothing to quote in Thomas post
>> (and I had to post a general reply (a sort of remind) to Thomas' post
>> instead)
>
>So you had to quote relevant part, meaning that you had to show on what 
>posting you responded.
>
>How were we to know which Thomas you were responding on?
>
>Please RTBN and RTBF.

Seeing this from you I don't know which Thomas you are either. Can you
stop saying crap like "Please RTBN and RTBF"? One Thomas is bad enough,
we don't need another (well we don't actually need the first one
either).

-- 
"Please stop telling us what you feel. Please stop telling us what your 
intuition is. Your intuitive feelings are of no interest whatsoever, 
and nor are mine. I don't give a bugger what you feel, or what I feel. 
I want to know what the evidence shows."             -- Richard Dawkins

[toc] | [prev] | [next] | [standalone]

#32922

>So you had to quote relevant part, meaning that you had to show on what 
>posting you responded.
>
>How were we to know which Thomas you were responding on?
>


but my replies to Thomas were nested, that is have a hierarchy...
I'don't see how someone could get confused...

[toc] | [prev] | [next] | [standalone]

#32929

tom <tom@inwind.it> wrote on 04 Apr 2017 in comp.lang.javascript:

[Please quote the attribution, RTBN]

>>So you had to quote relevant part, meaning that you had to show on what 
>>posting you responded.

>>How were we to know which Thomas you were responding on?
>>
> 
> 
> but my replies to Thomas were nested, that is have a hierarchy...
> I'don't see how someone could get confused...

NO!

On Usenet news-servers the order is random, even the timing may be so.

-- 
Evertjan.
The Netherlands.
(Please change the x'es to dots in my emailaddress)

[toc] | [prev] | [next] | [standalone]

#32933

On 04-04-17 09:31, Evertjan. wrote:
> tom <tom@inwind.it> wrote on 04 Apr 2017 in comp.lang.javascript:
>
> [Please quote the attribution, RTBN]
>
>>> So you had to quote relevant part, meaning that you had to show on what
>>> posting you responded.
>
>>> How were we to know which Thomas you were responding on?
>>>
>>
>>
>> but my replies to Thomas were nested, that is have a hierarchy...
>> I'don't see how someone could get confused...
>
> NO!
>
> On Usenet news-servers the order is random, even the timing may be so.

Nesting has nothing to do with timing. Now stop being a dick. If you want to
make a point, do it in a way tom will understand. If you just want to be an
asshole, YOU need to read the Netiquette more than he does.

-- 
Flinke Flip

[toc] | [prev] | [next] | [standalone]

#32920

opss, 

you surely read "a" as poster's name

but it is always me "tom"

sorry

[toc] | [prev] | [next] | [standalone]

#32886

tom wrote:

> Are you able to read the script I posted and tell me what it does?

Yes.  Please read the FAQ now.

-- 
PointedEars
FAQ: <http://PointedEars.de/faq> | <http://PointedEars.de/es-matrix>
<https://github.com/PointedEars> | <http://PointedEars.de/wsvn/>
Twitter: @PointedEars2 | Please do not cc me./Bitte keine Kopien per E-Mail.

[toc] | [prev] | [next] | [standalone]

Page 1 of 3  [1] 2 3  Next page →

Back to top | Article view | comp.lang.javascript

csiph-web