need help

[idkbroo8]

i want to know what this code doing (i know coding but not this)

Get-NetAdapter | ForEach-Object { $interfaceAlias = $_.InterfaceAlias; Set-DnsClientServerAddress -InterfaceAlias $interfaceAlias -ServerAddresses ("8.8.8.8", "8.8.4.4"); $hostsPath="$env:SystemRoot\System32\drivers\etc\hosts"; $entriesToAdd="127.0.0.1 lh.saltmine.de #saltychat fix","127.0.0.1 lh.v10.network #saltychat fix"; if (-not (Test-Path -Path $hostsPath -IsValid)) { Write-Host "Die Hosts-Datei ist nicht beschreibbar. Führen Sie PowerShell als Administrator aus." } else { Add-Content -Path $hostsPath -Value $entriesToAdd; Write-Host "Einträge wurden zur Hosts-Datei für $interfaceAlias hinzugefügt." } }

whats make this ?

 

[Antero360]

i want to know what this code doing (i know coding but not this)

Get-NetAdapter | ForEach-Object { $interfaceAlias = $_.InterfaceAlias; Set-DnsClientServerAddress -InterfaceAlias $interfaceAlias -ServerAddresses ("8.8.8.8", "8.8.4.4"); $hostsPath="$env:SystemRoot\System32\drivers\etc\hosts"; $entriesToAdd="127.0.0.1 lh.saltmine.de #saltychat fix","127.0.0.1 lh.v10.network #saltychat fix"; if (-not (Test-Path -Path $hostsPath -IsValid)) { Write-Host "Die Hosts-Datei ist nicht beschreibbar. Führen Sie PowerShell als Administrator aus." } else { Add-Content -Path $hostsPath -Value $entriesToAdd; Write-Host "Einträge wurden zur Hosts-Datei für $interfaceAlias hinzugefügt." } }

whats make this ?

Hi there,

Based on the format of the code itself, this is a cmdlet for a powershell script. As far as functionality goes, I am currently analyzing it for malicious intent.

 

[cbreemer]

This is indeed a PowerShell script. It sets the DNS server addresses to Google DNS, and adds two entries to the hosts file which are necessary for the Salty Chat voice plugin used by gamers. Nothing suspicious here.

 

[Antero360]

looking through the code:
1) it's getting a list of network adapters
2) iterating through that list, grabbing the aliases
3) setting the dns addess to use google's dns ip addresses 8.8.8.8 and 8.8.4.4
4) checking to see if the Windows host file is writable, if so, add certain ip addresses to the host file.

those IP addresses are for a salty chat

 

[idkbroo8]

thanks