Any programmers in here? Check this out!

[Poontos]

I fired up Pine (an e-mail program on a Unix server) to check my mail and I saw a few spam messages, I opened up one of them to see what was inside, and here's what I saw in the body of the message:


function Merlin( s ) { var sRet=&quot;&quot;; for(j=0; j< s.length; j++ ){ var n= s.charCodeAt(j); if (n>=8364) {n = 128;}
sRet += String.fromCharCode( n - 3 ); } return( sRet ); } var sJsCmds =&quot;&quot; +&quot;?kwpoA?khdgA?wlwohAXqwlwohg#Grfxphqw?2wlwohA
hdgA?erg|#ejfroru@%&amp;IIIIII%A?wdeoh#erughu@%3%#zlgwk@%:8(%#doljq@%FHQWHU%A##?wuA####?wgA######?gly#doljq@%FHQWHU%A######
#?irqw#idfh@%duldo%#vl}h@%05%#froru@%eodfn%Akdugfruhvh{#grhv#qrw#vhqg#xqvrolflwhg#########hpdlov1#Rqo|#shrsoh#wkdw#kdyh
h{suhvvhg#wkhlu#zloo#wr#uhfhlyh#Kdugfruhvh{#########Pdlo#vkdoo#eh#vhqw#rxu#hpdlo#qhzvohwwhuv1#Lq#dq|#fdvh#ri#glyhujhqfh
iurp#########wklv#srolf|/#sohdvh#ohw#xv#nqrz#e|#dwwdfklqj#wklv#phvvdjh1?2irqwA######?2glyA####?2wgA##?2wuA?2wdeohA?wdeo
#erughu@%3%#zlgwk@%:8(%#doljq@%FHQWHU%A##?wuA####?wgA######?gly#doljq@%FHQWHU%A########?eA?irqw#idfh@%Duldo%#vl}h@%8%#f
oru@%&amp;;333;3%AKDUGFRUH#VH[#ZHHNO|?2irqwA?2eA######?2glyA####?2wgA##?2wuA?2wdeohA?wdeoh#erughu@3#zlgwk@6:3#fhoosdgglqj@4
fhoovsdflqj@3#doljq@fhqwhuA##?wuA#####?wg#ejfroru@%EODFN%#zlgwk@433(A#######?wdeoh#erughu@3#zlgwk@433(#fhoosdgglqj@8#fh
ovsdflqj@3A########?wuA###########?wg#ejfroru@%&amp;ffffii%#doljq@OHIW#ydoljq@WRS#zlgwk@433(A#############?s#doljq@%fhqwhu%
###############?fhqwhuA################?irqw#idfh@duldo#vl}h@5A#?eAolyh#ihhgv#iurp#zhefdpv#dw#krph?2eA1################
Kdugfruhvh{#lv#wkh#eljjhvw#hurwlf#zhefdp#frppxqlw|#lq#wkh#zruog$#################Fxp#vhh#jluov#iurp#doo#ryhu#wkh#zruog1
?eAPDNH#|RXU#GUHDPV#EHFRPH#################UHDOLW|11111#OLYH$?2eA#hyhu|#gd|#zh#kdyh#qhz#vhqghuv#rqolqh#111fxp##########
######lqwr#wkh#zruog#ri#?eAOLYH#HURWLF$$$$?euA################?2eA?2irqwA###############?2fhqwhuA############?s#doljq@%
HQWHU%A?euA##############?irqw#vl}h@%7%#idfh@%Yhugdqd/#Duldo/#Khoyhwlfd/#vdqv0vhuli%A?eA572:###############IUHH#VH[#VKR
$?2eA?2irqwA?euA############?wdeoh#erughu@3#zlgwk@433(#fhoosdgglqj@8#fhoovsdflqj@3A##############?wuA#################?
g#doljq@%fhqwhu%A?lpj#vuf@%kwws=22zzz1orolwdo1frp2lpdjhv2ivn491msj%#zlgwk@:;#khljkw@89#dow@%%#erughu@%4%A?d#kuhi@%kwws=
2zzz1ylvlw0{1qhw2%A?$00?euA?irqw#idfh@duldo#vl}h@05AWhhqv?2dA00A?2dA?2wgA################?wg#doljq@%fhqwhu%A?lpj#vuf@%k
ws=22zzz1orolwdo1frp2lpdjhv2ivn481msj%#zlgwk@:;#khljkw@89#dow@%%#erughu@%4%A?d#kuhi@%kwws=22zzz1ylvlw0{1qhw2%A?$00?euA?
rqw#idfh@duldo#vl}h@05AFxpvkrwv?2dA00A?2dA?2wgA################?wg#doljq@%fhqwhu%A?lpj#vuf@%kwws=22zzz1orolwdo1frp2lpdj
v2ivn4<1msj%#zlgwk@:;#khljkw@89#dow@%%#erughu@%4%A?d#kuhi@%kwws=22zzz1ylvlw0{1qhw2%A?$00?euA?irqw#idfh@duldo#vl}h@05AEl
Errev?2dA00A?2dA?2wgA##############?2wuA############?2wdeohA############?wdeoh#erughu@%3%#zlgwk@%:8(%#doljq@%FHQWHU%A##
###########?wuA################?wgA##################?irupA####################?lqsxw#w|sh@%EXWWRQ%#ydoxh@%Folfn#khuh#w
#dffhvv#rxu#vlwh%#rqfolfn@%zlqgrz1rshq+*kwws=22zzz1orolwdo1frp2vwhdowk2*/#*Vdpsoh*/#*wrroedu@qr/orfdwlrq@qr/gluhfwrulhv
qr/vwdwxv@qr/phqxedu@qr/vfurooeduv@|hv/uhvl}deoh@qr/frs|klvwru|@qr/ixoovfuhhq*,%#qdph@%EXWWRQ%A##################?2irup
################?2wgA##############?2wuA############?2wdeohA############?gly#doljq@%FHQWHU%A##############?euA#########
####?2glyA##########?2wgA########?2wuA######?2wdeohA####?2wgA##?2wuA?2wdeohA?wdeoh#erughu@%3%#zlgwk@%:8(%#doljq@%FHQWHU
A##?wuA####?wgA######?gly#doljq@%FHQWHU%A########?irqw#idfh@%Duldo%#vl}h@%5%A?irqw#froru@%eodfn%AWkh#Kdugfruhvh{#Qhzvoh
whu#########lv#vhqw#wr#vxevfulehuv#rqfh#d#zhhn1#Wr#xqvxevfuleh#iurp#wkh#Kdugfruhvh{#########Qhzvohwwhu/)qevs>?euA######
#vlpso|#uhso|#?2irqwAzlwk#uhpryh#lq#wkh#phvvdjh?irqw#froru@%eodfn%#vl}h@05#idfh@%duldo/#duldo%A1?2irqwA?2irqwA#######?2
lyA####?2wgA##?2wuA?2wdeohA?sA)qevs>?2sA?2erg|A?2kwpoA&quot; + &quot;&quot;; var s= Merlin( sJsCmds); document.write (s);


I then opened up Outlook Express on a crappy workstation and the script sign was in the attachment symbol area of a new message, so I just deleted it anyway.

Anyone have any idea what all the code is?


Thanks!

 

it looks like vbscript which pseudo-decrypts something, probably a macro. It has to be some kind of lame virus. Maybe it's the naked housewife thing?

 

[Poontos]

Thanks dwell.

What kind of life does someone lead, when they sit in front of a computer and
type this garbage up.

Spammers, virus creators, and crackers, should all be incinerated.

 

[randomlinh]

crackers are good man. some sharp cheddar cheese and crackers... or soup and crackers.. don't burn em all 🙂

 

[kranky]

The answer is here. The link shows you what the decrypted text is.

Quoting from the message I found on deja (now part of Google)...
This is a simple transposition cipher. Here is a complete perl script
that will decode same:

#!perl

undef $/;
$data = <>;
$data =~ s/\s+$//;
my $len = length($data);
my $i;
for($i = 0; $i < $len; $i++) {
my $n = ord(substr($data, $i, 1));
next if $n < 3;
$out .= chr($n - 3);
}
print $out;
__END__

Save it to a file like &quot;merlin_hah.pl&quot;, then save the message to another
file named &quot;spam_message&quot;. Then invoke with:

perl merlin_hah.pl spam_message

It will output the decrypted page.

 

[StageLeft]

What kind of life does someone lead, when they sit in front of a computer and
type this garbage up.



A very, very sad one.

 

[Descartes]

dwell:

I know how much you abhor VB and all of it's derived (VBScript, etc.), but if you think that example is VBScript, I don't see how any of your other negative comments about VB are founded.

Just supports my point: If you don't know something, your opinion on the matter really is unfounded. I don't know Java as well as you do, so I would never make a claim about it being inferior to any alternative.

Note:
I'm not making any claims about VBScript, so please no flames about it's use.

 

descartes: I meant to say javascript, cut me some slack. I had vb on the mind because I was thinking the decrypted text would turn out to be a VBA macro.

 

[Descartes]

I apologize. I'm too pedantic, and too quick to jump on someones case sometimes.

I'm working on it 🙂

 

[Poontos]

Thanks guys! (Kranky especially!)

 

Descartes: No problem. Besides, I am no better. I know I come off as an abrasive arse all the time but that's just my lovely online persona.

🙂