Jump to content
LegendKiller

cateva coduri ciudate in .html

Recommended Posts

The script is executed each time the user opens the infected disk using the Windows Explorer if the autoplay function is turned on. Being executed, the script launches the "<rnd_2>.exe" file. Shortcuts created by the malicious program are exploits which use the CVE-2010-2568 vulnerability. In the "shell32.dll" library, this vulnerability consists in error of the shortcut processing (lnk and .pif files) and allows launching a code of random Windows libraries when hitting icons to open programs by the Windows Explorer. The code of the "<rnd_1>.cpl" library is launched. Being executed, it launches the "<rnd_2>.exe" file. The malicious program prevents modifying the files described above and creates them in an endless cycle.

File Infection

The virus infects files with the following extensions:

exe

html

dll

htm

E grele limbele engleze :)).

Link to comment
Share on other sites

In pagina respectiva se gaseste un droper(adica este o pagina ce odata vizitata instaleaza pe calculatorul vizitatorului un virus, sau incearca sa instaleze un virus).

Sugerez sa le stergi sau, si mai bine, sa cauti alta tema, intrucat aia sigur e plina de tot felul de gauri si probabil si backdoor-uri(modalitati prin care un hacker - cel ce probabil a creat/editat tema respectiva - sa poata obtine access la serverele celor ce ii folosesc tema).

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.



×
×
  • Create New...