Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.javascript > #32870 > unrolled thread

This is a VIRUS - how does it works?

Back to article view | Back to comp.lang.javascript

Contents

  This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-03-30 14:37 +0200
    Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-03-30 14:43 +0200
      Re: This is a VIRUS - how does it works? Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2017-03-30 18:32 +0200
    Re: This is a VIRUS - how does it works? Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2017-03-30 18:31 +0200
      Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-03-30 21:22 +0200
        Re: This is a VIRUS - how does it works? "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2017-03-30 23:20 +0200
          Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-03-31 14:00 +0200
            Re: This is a VIRUS - how does it works? "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2017-03-31 17:26 +0200
              Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-04-01 22:00 +0200
                Re: This is a VIRUS - how does it works? "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2017-04-01 22:11 +0200
                  Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-04-02 21:02 +0200
                    Re: This is a VIRUS - how does it works? "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2017-04-02 22:50 +0200
                      Re: This is a VIRUS - how does it works? a <a@inwind.it> - 2017-04-03 23:18 +0200
                        Re: This is a VIRUS - how does it works? "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2017-04-03 23:22 +0200
                          Re: This is a VIRUS - how does it works? Tim Streater <timstreater@greenbee.net> - 2017-04-03 22:41 +0100
                          Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-04-04 00:58 +0200
                            Re: This is a VIRUS - how does it works? "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2017-04-04 09:31 +0200
                              Re: This is a VIRUS - how does it works? Flippie Flink <flip@flink.not> - 2017-04-04 12:09 +0200
                        Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-04-04 00:50 +0200
        Re: This is a VIRUS - how does it works? Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2017-03-31 00:51 +0200
          Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-03-31 14:05 +0200
            Re: This is a VIRUS - how does it works? Wally W. <ww84wa@aim.com> - 2017-03-31 11:54 -0400
              Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-04-01 21:56 +0200
    Re: This is a VIRUS - how does it works? Stefan Weiss <krewecherl@gmail.com> - 2017-04-02 01:07 +0200
      Re: This is a VIRUS - how does it works? Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2017-04-02 14:31 +0200
        Re: This is a VIRUS - how does it works? Stefan Weiss <krewecherl@gmail.com> - 2017-04-02 15:07 +0200
          Re: This is a VIRUS - how does it works? Thomas 'PointedEars' Lahn <PointedEars@web.de> - 2017-04-14 22:10 +0200
      Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-04-02 21:45 +0200
        Re: This is a VIRUS - how does it works? Stefan Weiss <krewecherl@gmail.com> - 2017-04-03 03:03 +0200
          Re: This is a VIRUS - how does it works? a <a@inwind.it> - 2017-04-04 00:45 +0200
            Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-04-04 00:50 +0200
            Re: This is a VIRUS - how does it works? Stefan Weiss <krewecherl@gmail.com> - 2017-04-04 02:51 +0200
              Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-04-06 23:54 +0200
                Re: This is a VIRUS - how does it works? "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2017-04-07 09:03 +0200
                  Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-04-07 23:05 +0200
                    Re: This is a VIRUS - how does it works? "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2017-04-07 23:48 +0200
                      Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-04-08 14:09 +0200
                        Re: This is a VIRUS - how does it works? "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2017-04-08 14:32 +0200
    Re: This is a VIRUS - how does it works? "Chris M. Thomasson" <invalid@invalid.invalid> - 2017-04-03 14:31 -0700
      Re: This is a VIRUS - how does it works? "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2017-04-03 23:34 +0200
        Re: This is a VIRUS - how does it works? Andrew Poulos <ap_prog@hotmail.com> - 2017-04-04 11:35 +1000
          Re: This is a VIRUS - how does it works? "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2017-04-04 09:36 +0200
      Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-04-04 00:59 +0200
        Re: This is a VIRUS - how does it works? "Chris M. Thomasson" <invalid@invalid.invalid> - 2017-04-03 16:08 -0700
          Re: This is a VIRUS - how does it works? "Chris M. Thomasson" <invalid@invalid.invalid> - 2017-04-03 16:17 -0700
          Re: This is a VIRUS - how does it works? "Chris M. Thomasson" <invalid@invalid.invalid> - 2017-04-05 13:58 -0700
        Re: This is a VIRUS - how does it works? "Chris M. Thomasson" <invalid@invalid.invalid> - 2017-04-19 12:59 -0700
          Re: This is a VIRUS - how does it works? "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2017-04-20 00:13 +0200
            Re: This is a VIRUS - how does it works? "Chris M. Thomasson" <invalid@invalid.invalid> - 2017-04-19 16:59 -0700
              Re: This is a VIRUS - how does it works? "Evertjan." <exxjxw.hannivoort@inter.nl.net> - 2017-04-20 08:49 +0200
                Re: This is a VIRUS - how does it works? "Chris M. Thomasson" <invalid@invalid.invalid> - 2017-05-01 13:40 -0700
    Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-04-12 14:06 +0200
      Re: This is a VIRUS - how does it works? <cyber@2trom.com> - 2017-04-12 13:59 +0000
        Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-04-12 22:23 +0200
          Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-04-12 22:28 +0200
          Re: This is a VIRUS - how does it works? <cyber@2trom.com> - 2017-04-12 21:55 +0000
          Re: This is a VIRUS - how does it works? "Michael Haufe (TNO)" <tno@thenewobjective.com> - 2017-04-14 12:34 -0700
            Re: This is a VIRUS - how does it works? tom <tom@inwind.it> - 2017-04-14 22:42 +0200

Page 3 of 3 — ← Prev page 1 2 [3]

#32927

On 4/04/2017 7:34 AM, Evertjan. wrote:
> "Chris M. Thomasson" <invalid@invalid.invalid> wrote on 03 Apr 2017 in
> comp.lang.javascript:
>
>> Anyway, do not go to certain websites as well!
>
> ... and NEVER go out with strangers!
>
> <https://youtu.be/hlSbSKNk9f0>

Apparently Sintra hated the song "strangers in the night".

Andrew Poulos

[toc] | [prev] | [next] | [standalone]

#32930

Andrew Poulos <ap_prog@hotmail.com> wrote on 04 Apr 2017 in 
comp.lang.javascript:

> On 4/04/2017 7:34 AM, Evertjan. wrote:
>> "Chris M. Thomasson" <invalid@invalid.invalid> wrote on 03 Apr 2017 in
>> comp.lang.javascript:
>>
>>> Anyway, do not go to certain websites as well!
>>
>> ... and NEVER go out with strangers!
>>
>> <https://youtu.be/hlSbSKNk9f0>
> 
> Apparently Sintra hated 

But for his purse, I presume.

> the song "strangers in the night".

Why should authority be more important than your own perception of beauty.

I heard that there are people that like to watch Europen football.

Now reality and truth do not go by subjective perception, 
they go by applying logic to evidence.

-- 
Evertjan.
The Netherlands.
(Please change the x'es to dots in my emailaddress)

[toc] | [prev] | [next] | [standalone]

#32923

On Mon, 3 Apr 2017 14:31:23 -0700, "Chris M. Thomasson"
<invalid@invalid.invalid> wrote:

>On 3/30/2017 5:37 AM, tom wrote:
>> Hallo,
>>
>> i received an email from a fake DHL corrier (about a package delivering),
>> it had an attachment,
>> the attachment was a "ST6890945.zip" file,
>> it contained a .jse file,
>> the file is "ST6890945.jse"
>[...]
>
>Do NOT open it!
>
>Anyway, do not go to certain websites as well!
>
>I remember that there was a crazy virus in Bob Lazars website that auto 
>downloaded a trojan on windows, around 10-13 years ago. It was real.

I did it

[toc] | [prev] | [next] | [standalone]

#32924

On 4/3/2017 3:59 PM, tom wrote:
> On Mon, 3 Apr 2017 14:31:23 -0700, "Chris M. Thomasson"
> <invalid@invalid.invalid> wrote:
>
>> On 3/30/2017 5:37 AM, tom wrote:
>>> Hallo,
>>>
>>> i received an email from a fake DHL corrier (about a package delivering),
>>> it had an attachment,
>>> the attachment was a "ST6890945.zip" file,
>>> it contained a .jse file,
>>> the file is "ST6890945.jse"
>> [...]
>>
>> Do NOT open it!
>>
>> Anyway, do not go to certain websites as well!
>>
>> I remember that there was a crazy virus in Bob Lazars website that auto
>> downloaded a trojan on windows, around 10-13 years ago. It was real.
>
> I did it
>

It infected my virtual machine! I refused to go back since then. Are you 
trying to say its still fuc%ing there?

[toc] | [prev] | [next] | [standalone]

#32925

On 4/3/2017 4:08 PM, Chris M. Thomasson wrote:
> On 4/3/2017 3:59 PM, tom wrote:
>> On Mon, 3 Apr 2017 14:31:23 -0700, "Chris M. Thomasson"
>> <invalid@invalid.invalid> wrote:
>>
>>> On 3/30/2017 5:37 AM, tom wrote:
>>>> Hallo,
>>>>
>>>> i received an email from a fake DHL corrier (about a package
>>>> delivering),
>>>> it had an attachment,
>>>> the attachment was a "ST6890945.zip" file,
>>>> it contained a .jse file,
>>>> the file is "ST6890945.jse"
>>> [...]
>>>
>>> Do NOT open it!
>>>
>>> Anyway, do not go to certain websites as well!
>>>
>>> I remember that there was a crazy virus in Bob Lazars website that auto
>>> downloaded a trojan on windows, around 10-13 years ago. It was real.
>>
>> I did it
>>
>
> It infected my virtual machine! I refused to go back since then. Are you
> trying to say its still fuc%ing there?

I bet it was a damn viral ci(ascii dec 97) thing. ;^)

[toc] | [prev] | [next] | [standalone]

#32944

On 4/3/2017 4:08 PM, Chris M. Thomasson wrote:
> On 4/3/2017 3:59 PM, tom wrote:
>> On Mon, 3 Apr 2017 14:31:23 -0700, "Chris M. Thomasson"
>> <invalid@invalid.invalid> wrote:
>>
>>> On 3/30/2017 5:37 AM, tom wrote:
>>>> Hallo,
>>>>
>>>> i received an email from a fake DHL corrier (about a package
>>>> delivering),
>>>> it had an attachment,
>>>> the attachment was a "ST6890945.zip" file,
>>>> it contained a .jse file,
>>>> the file is "ST6890945.jse"
>>> [...]
>>>
>>> Do NOT open it!
>>>
>>> Anyway, do not go to certain websites as well!
>>>
>>> I remember that there was a crazy virus in Bob Lazars website that auto
>>> downloaded a trojan on windows, around 10-13 years ago. It was real.
>>
>> I did it
>>
>
> It infected my virtual machine!

Iirc, I had zonealarm installed, and it popped up a confirmation wrt 
letting me choose to let a program contact some ip address. Btw, check 
this out:

https://www.grc.com/zonealarm.htm



> I refused to go back since then. Are you
> trying to say its still fuc%ing there?

[toc] | [prev] | [next] | [standalone]

#33061

On 4/3/2017 3:59 PM, tom wrote:
> On Mon, 3 Apr 2017 14:31:23 -0700, "Chris M. Thomasson"
> <invalid@invalid.invalid> wrote:
>
>> On 3/30/2017 5:37 AM, tom wrote:
>>> Hallo,
>>>
>>> i received an email from a fake DHL corrier (about a package delivering),
>>> it had an attachment,
>>> the attachment was a "ST6890945.zip" file,
>>> it contained a .jse file,
>>> the file is "ST6890945.jse"
>> [...]
>>
>> Do NOT open it!
>>
>> Anyway, do not go to certain websites as well!
>>
>> I remember that there was a crazy virus in Bob Lazars website that auto
>> downloaded a trojan on windows, around 10-13 years ago. It was real.
>
> I did it
>

Well, I remember that not only did it auto download, it fuc%ing executed 
right when one went to the page.

[toc] | [prev] | [next] | [standalone]

#33063

"Chris M. Thomasson" <invalid@invalid.invalid> wrote on 19 Apr 2017 in 
comp.lang.javascript:

> Well, I remember that not only did it auto download, it fuc%ing executed 
> right when one went to the page.

Modern browsers do not autodownload and autoexecute virusses from a webpage,
unless you changed the default securitysettings.

"fuc%ing"?

Do you mean "fucking"?

-- 
Evertjan.
The Netherlands.
(Please change the x'es to dots in my emailaddress)

[toc] | [prev] | [next] | [standalone]

#33064

On 4/19/2017 3:13 PM, Evertjan. wrote:
> "Chris M. Thomasson" <invalid@invalid.invalid> wrote on 19 Apr 2017 in
> comp.lang.javascript:
>
>> Well, I remember that not only did it auto download, it fuc%ing executed
>> right when one went to the page.
>
> Modern browsers do not autodownload and autoexecute virusses from a webpage,
> unless you changed the default securitysettings.
>
> "fuc%ing"?
>
> Do you mean "fucking"?
>
Yes. It was using fucking internet explorer 5, or 6, can't quite 
remember right now.

I opened the page, and zonealarm popped up after several files were 
stored on my virtual hard drive. It was going to download more files. 
Well, that is executing, imvvvho.

I opened the browser, went to the page, and shi% happened!

The security settings in the browser had to be fucked, but damn.

[toc] | [prev] | [next] | [standalone]

#33071

"Chris M. Thomasson" <invalid@invalid.invalid> wrote on 20 Apr 2017 in
comp.lang.javascript: 

>> Modern browsers do not autodownload and autoexecute virusses from a
>> webpage, unless you changed the default securitysettings.
>>
>> "fuc%ing"?
>>
>> Do you mean "fucking"?
>>
> Yes. It was using fucking internet explorer 5, or 6, can't quite 
> remember right now.
> 
> I opened the page, and zonealarm popped up after several files were 
> stored on my virtual hard drive. It was going to download more files. 
> Well, that is executing, imvvvho.
> 
> I opened the browser, went to the page, and shi% happened!

What the shit is wrong with your keyboard?

> The security settings in the browser had to be fucked, but damn.

Ah yes, the trust we had in those flying circuses as small children.

-- 
Evertjan.
The Netherlands.
(Please change the x'es to dots in my emailaddress)

[toc] | [prev] | [next] | [standalone]

#33162

On 4/19/2017 11:49 PM, Evertjan. wrote:
> "Chris M. Thomasson" <invalid@invalid.invalid> wrote on 20 Apr 2017 in
> comp.lang.javascript:
>
>>> Modern browsers do not autodownload and autoexecute virusses from a
>>> webpage, unless you changed the default securitysettings.
>>>
>>> "fuc%ing"?
>>>
>>> Do you mean "fucking"?
>>>
>> Yes. It was using fucking internet explorer 5, or 6, can't quite
>> remember right now.
>>
>> I opened the page, and zonealarm popped up after several files were
>> stored on my virtual hard drive. It was going to download more files.
>> Well, that is executing, imvvvho.
>>
>> I opened the browser, went to the page, and shi% happened!
>
> What the shit is wrong with your keyboard?

Its a habit. I sometimes self censor my curse words with a % or ? char. 
Sorry.

>
>> The security settings in the browser had to be fucked, but damn.
>
> Ah yes, the trust we had in those flying circuses as small children.

Thank god it was in a virtual environment! ;^o

[toc] | [prev] | [next] | [standalone]

#32996

Hallo,
here me back;

I didn't find a safe solution to execute the virus
Stefan isolated and linked for me few posts ago
on my Windows10 to see what it does
(creating a virtual machine is too busy).

So the only thing that remained to me to do 
was to clean my (presumed) affected machine more and more,
so I run 4 (out of 6) free antiviruses 
that the site www.virustotal.com told me 
they were able to detect something about the virus
(I linked the site page few posts ago).

So I run 'Avira', 'Kaspersky', 'McAfee' and 'Trend Micro'
(I also tried 'Symantec Norton', but during its installation
it required a registration so I didn't go on with it).

I performed the deepest scan everytime
and they didn't find anything on my machine
(as you know, days ago I run 3 other different free antiviruses too).

So my situation is this:

- I don't know what the second part of the malicious activity
of the virus can consist of (the first part has been described by Stefan)
- seven antivirus didn't find anything 
(or to better say the very first one found something and deleted it) 
- as you know we can't rely 100% on the antivirus software,
so I'm not feeling totally safe.


Thank you.

[toc] | [prev] | [next] | [standalone]

#32997

tom <tom@inwind.it> wrote:
> Newsgroups: comp.lang.javascript
> I didn't find a safe solution to execute the virus
> Stefan isolated and linked for me few posts ago
> on my Windows10 to see what it does
> (creating a virtual machine is too busy).

Can you send me the virus please?
I want to see it but I came too late to get it from his link.

Also why can you not safely execute it?
Could you not just execute it in a virtual machine?

[toc] | [prev] | [next] | [standalone]

#32998

On Wed, 12 Apr 2017 13:59:00 GMT, <cyber@2trom.com> wrote:

>tom <tom@inwind.it> wrote:
>> Newsgroups: comp.lang.javascript
>> I didn't find a safe solution to execute the virus
>> Stefan isolated and linked for me few posts ago
>> on my Windows10 to see what it does
>> (creating a virtual machine is too busy).
>
>Can you send me the virus please?
>I want to see it but I came too late to get it from his link.
>
>Also why can you not safely execute it?
>Could you not just execute it in a virtual machine?


Here a link where you can download it from.
Rename it from "bbb.png" to "bbb.exe".
You will find also a simple .txt file (it is a warning message, 
just ignore it).


Do you know a way to safely defend my Windows10 64 bit machine
from its execution?

[toc] | [prev] | [next] | [standalone]

#32999

On Wed, 12 Apr 2017 22:23:17 +0200, tom <tom@inwind.it> wrote:

>Here a link where you can download it from.

http://s000.tinyupload.com/index.php?file_id=23223191543652157995

[toc] | [prev] | [next] | [standalone]

#33000

tom <tom@inwind.it> wrote:
> Newsgroups: comp.lang.javascript
> 
> On Wed, 12 Apr 2017 13:59:00 GMT, <cyber@2trom.com> wrote:
> 
> Do you know a way to safely defend my Windows10 64 bit machine
> from its execution?

Well I kind of suggested a virtual machine but I like to add
that those are not a 100% safe way to execute a virus. So
do not do that if you want to be 100% safe. 

But since your computer has already been infected, probably the 
only way to be 100% safe is to delete the whole os anyway.

Actually since Windows 10 is spyware the only way to be safe is
to not have Windows 10 on your machine at all but it seems that
most people are not as bothered as I am by the fact that M$ could
look at all the users files and send them to NSA or the highest
bidder.

[toc] | [prev] | [next] | [standalone]

#33006

tom wrote:

> Do you know a way to safely defend my Windows10 64 bit machine
> from its execution?

Windows Defender will delete the file as soon as you unzip it. I suggest using it

[toc] | [prev] | [next] | [standalone]

#33008

On Fri, 14 Apr 2017 12:34:00 -0700 (PDT), "Michael Haufe (TNO)"
<tno@thenewobjective.com> wrote:

>tom wrote:
>
>> Do you know a way to safely defend my Windows10 64 bit machine
>> from its execution?
>
>Windows Defender will delete the file as soon as you unzip it. I suggest using it

Wait... 
what I wanted to mean
is that I *do* want to execute it,
but I also would need a way to perfectly monitorize what the virus does,
so to later clean it and its infections.
Or to better say... I wanted all of this...
because now I'm a little tired (it took me several hours till now...) 

Note:
this virus has been already automatically
executed on my machine, by the .jse file.
But actually I don't know what this virus did:
I didn't reboot the machine and immediately run Spyhunter.
Spyhunter found and cleaned something 
but I don't know if it cleaned this virus and its infections
or a different and old virus and its infections only).

[toc] | [prev] | [standalone]

Page 3 of 3 — ← Prev page 1 2 [3]

Back to top | Article view | comp.lang.javascript

csiph-web