How does it work?

>>58088564
it doesn't?

File: gimp-output.png (207KB, 336x210px) Image search: [Google]

207KB, 336x210px

What's supposed to happen?

Depending on the extension to a file your operating system will read that file in a completely different way. Right now the extension to it is .png, so your operating system reads it as a perfectly safe picture. But apparently there is such data within the file that if it was ran as a .hta then it would cause some malware

File: 1451475963561.png (251KB, 384x400px) Image search: [Google]

251KB, 384x400px

>>58088564
Thats not a feal picture with loaded malware. Its a perfectly safe banner made for memeing purposes. Real thing in pic related.

>>58090059
what does it do?

>>58091854
It invites you to join anonymous

>>58092111
no but seriously, I don't have ms paint, can you just tell me what it does?

>>58092177
I honestly dont know, never run it. But if recall right it should overwrite your boot sector, or just delete system32

One of the later versions would copy itself and one of the "user's" personal files and upload them to 4chan.

>>58092177
botnets your ass to spam on /b/ and also spread itself

>>58092177
It was a literal botnet. It would just repeatedly spam 4chan with these images which contain a copy of itself. The later versions were more malicious. One of them would also copy a random personal file from the victim's computer.

>>58092310
No, that thing made you join a botnet.
Can't remember all the details, but it auto-posted that image and other like it from your computer to /b/, maybe other boards as well but I can't remember.
It's one reason 4chan started using captcha.

>>58092404
how does it work?

>>58092452
By saving it as a bmp the entire file would be uncompressed including the program code. Then when you change the extension you make the program executable on windows. So it's literally telling the victim to uncompress it and then run it.

Obviously the only people that fell for it are complete imbeciles which sadly makes up a large percentage of this site's users.

>>58092536
I ran it in a VM with no networking to see what would happen. Nothing happened

>>58092554
I think the banner one is just a joke and not an actual one. I'm not sure though. I thing the original ones were bigger than that.

>>58092452
just read it.
the code is pretty well written if i remember.

>>58092404
I always thought it was just an elaborate delete sys32 lure.