+ Post New Thread
Results 1 to 11 of 11
Scripts Thread, Does anyone recognize this script? in Coding and Web Development; A student at our academy has created a seeminlgy malicious script and saved it in his home folder: ================================================== =========== ...
  1. #1

    Join Date
    Sep 2012
    Posts
    2
    Thank Post
    0
    Thanked 1 Time in 1 Post
    Rep Power
    0

    Unhappy Does anyone recognize this script?

    A student at our academy has created a seeminlgy malicious script and saved it in his home folder:

    ================================================== ===========
    ()
    ("Run File2)
    (2)
    (Edit File)
    (User ISD)("AC36")
    (Corrupt File)(error 0x983le)
    (Files; Remove,)
    (AppDataRestart)
    (MKS.message ("Your Computer Has Been Reset")
    (ShutDown.ISD.)
    () )
    ""Run FlashMode.k61.""
    (6.872)
    'HardDrive:
    Refresh"0x983le"

    ("Virus Detected")()
    (3)(OS.Reset.15(8)
    (End)
    ()
    ()
    os.Reset

    =======

    Does anyone recognize the language and can tell me what script engine it is for?

    Many thanks

  2. #2

    Steve21's Avatar
    Join Date
    Feb 2011
    Location
    Swindon
    Posts
    2,656
    Thank Post
    324
    Thanked 506 Times in 474 Posts
    Rep Power
    177
    Quote Originally Posted by pshall View Post
    Does anyone recognize the language and can tell me what script engine it is for?

    Many thanks
    I think it's called boredism Either that or some game "hack" website.

    Steve

  3. #3

    Join Date
    Nov 2009
    Location
    Manchester
    Posts
    1,010
    Thank Post
    6
    Thanked 181 Times in 169 Posts
    Rep Power
    49
    Looks like pseudocode to be honest, that is code that is kind of a plan of what is going to happen, but in terminology that is readable, as oppose to actual coding.

  4. #4

    X-13's Avatar
    Join Date
    Jan 2011
    Location
    /dev/null
    Posts
    8,004
    Thank Post
    508
    Thanked 1,591 Times in 1,122 Posts
    Blog Entries
    19
    Rep Power
    700
    Looks made up to me.

    It sort of references things, but I can't find any scripting language that looks like that.

    Shutdown.ISD for example.

    ISD, from what I know is Overcurrent shutdown.

    Overcurrent shutdown (ISD)
    Each phase has an overcurrent shutdown circuit, which turns off the corresponding outputs when the output current exceeds the shutdown trip threshold (above the maximum current rating: 2.0 A minimum). The TB62208FTG exits ISD mode and resumes normal operation when the STANDBY pin is changed from High to Low and then to High. This circuit provides protection against short-circuit by temporarily disabling the device. Important notes on this feature will be provided later.
    Source. [Page 5.]


    Le EDIT: Took too long... stupid work distracting me.
    Last edited by X-13; 24th October 2012 at 02:25 PM.

  5. #5

    Steve21's Avatar
    Join Date
    Feb 2011
    Location
    Swindon
    Posts
    2,656
    Thank Post
    324
    Thanked 506 Times in 474 Posts
    Rep Power
    177
    Well the easiest bit "imo" is this "0x983le" if it's hex, then L can't exist in it....

    Steve

  6. #6
    AWicher's Avatar
    Join Date
    Nov 2008
    Location
    Preston
    Posts
    316
    Thank Post
    57
    Thanked 40 Times in 31 Posts
    Rep Power
    17
    lol, comical low of the low, a wannabe script kiddy.

    How did you find it out of curiosity?

  7. #7

    Join Date
    Sep 2012
    Posts
    2
    Thank Post
    0
    Thanked 1 Time in 1 Post
    Rep Power
    0
    The student was caught typing and saving it whilst being secretly monitored using Impero.

    As for its content, I was hoping someone would recogize the general syntax - especially the parentesis around every command. The details are system specific - ISD is a local user name (it is the initials of our support department).

    Thanks for the replies so far.

  8. Thanks to pshall from:

    russdev (24th October 2012)

  9. #8

    localzuk's Avatar
    Join Date
    Dec 2006
    Location
    Minehead
    Posts
    17,096
    Thank Post
    511
    Thanked 2,310 Times in 1,786 Posts
    Blog Entries
    24
    Rep Power
    803
    Looks like the sort of thing someone could use as a trick - ie. stick some echos in there and @echo off and confuse someone.

  10. #9

    SYNACK's Avatar
    Join Date
    Oct 2007
    Posts
    10,692
    Thank Post
    824
    Thanked 2,570 Times in 2,187 Posts
    Blog Entries
    9
    Rep Power
    731
    Quote Originally Posted by Achandler View Post
    Looks like pseudocode to be honest, that is code that is kind of a plan of what is going to happen, but in terminology that is readable, as oppose to actual coding.
    Agreed, if I was to look into their intent, casuse an 'error' reboot, reflash the hd firmware with a new mbr (fail, they are two completely different things), fail with an error each time someone tries to boot.

    The code would not do that without some major help from a very specific interpreter which probably does not exist and if it does should be an exe blocked by your policies.

  11. #10
    kernewek-sam's Avatar
    Join Date
    Sep 2010
    Location
    UK
    Posts
    257
    Thank Post
    60
    Thanked 50 Times in 46 Posts
    Rep Power
    67
    Is it possible the student is just showing this to her/his mates to show off rather than it doing anything.

  12. #11
    ADMaster's Avatar
    Join Date
    May 2012
    Posts
    264
    Thank Post
    4
    Thanked 26 Times in 22 Posts
    Rep Power
    12
    it is not a language I recognize, in addition to the "l" in the hex he has a few mis-matched quotes and parentheses.
    I agree it looks like it is a joke / showing off.

    What was the file name and extension, the extension will give you a clue to what language he thought it was.

SHARE:
+ Post New Thread

Similar Threads

  1. Quick buy now! - does anyone do this?
    By jamesfed in forum Hardware
    Replies: 2
    Last Post: 16th September 2011, 11:51 PM
  2. Replies: 12
    Last Post: 8th August 2011, 05:15 PM
  3. Does anyone recognise this?
    By Edu-IT in forum General Chat
    Replies: 3
    Last Post: 24th March 2008, 10:19 PM
  4. Does anyone have a script...
    By wesleyw in forum Scripts
    Replies: 4
    Last Post: 5th July 2007, 01:58 PM

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •