These virus appears to create a simple and long string with a modified base 64 encoding. It also copy itself to C:\Users\\AppData\Roaming to every user on computer. The script itself include a few keys to the windows' registry to autostart on S.O. it appears when the user click on the link, they execute the cool.vbs script. These links points to "wbscript /b cool.vbs
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |