This application is a rogue antivirus that shows a fake system scan and misleading results (a very infected computer) in order to determine the user to register/buy this product.The malware will run at every system startup, as it sets the following r... [More]

The attack begins when the victim visits an infected page and thus running the script. The malware consists of a javascript that is obfuscated to conceal the actions and means of the attack. After decription the script verifies if the victim has an v... [More]

This file usually comes bundled with other types of malware. The file analyzed came with Backdoor.Agent.ZHQ. When executed the dropper first resolves its imports and after that checks to see if it is being ran by a virus analyst. It checks to see if ... [More]

LI.workaround {PADDING-LEFT: 10px; MARGIN: 0px; LIST-STYLE-TYPE: disc; TEXT-ALIGN: left} The Javascript has more layers of encrypted data and downloads other pieces of malware. It tries different approaches on how to download a malicious file.The dow... [More]

Trojan.Obfuscated.LA is a trojan downloader. It tries to download a file from hxxp://upd.host-domain-look.com/upd/check?version=0.1unk... [More]

Wnen executed, the trojan creates the file %SYSDIR%\WinCtrl32.dll and creates the following registry keys:[HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Winctrl32]DllName=WinCtrl32.dllStartShell=WLEventStartShell , in orde... [More]

The malware makes part of a web page that asks the user to download a certain codec or ActiveX component that supposedly helps viewing the content of an (usually inexistent) video file embedded in the page.The malware is written in Java Script and it... [More]

Trojan.Swizzor.1 is the name for a generic detection of an obfuscated downloader that usually comes bundled with other software (like 3wPlayer or such called BitTorrent optimization tools).When such an tool is installed, it downloads a copy of Trojan... [More]

The malware exploits a vulnerability in the ActiveX control for the Snapshot Viewer present in some versions of Microsoft Access. It downloads a file onto the affected computer which may be a piece of malware and uses this CLSID {F0E42D50-368C-11D0-A... [More]

The malware drops 2 files to the system directory:1) C:\WINDOWS\system32\blphc9pvj0e1ac.scr- which is the bluescreen screenserver joke fromSysinternals.This is intended to scare the user that something went wrong with his computer and a bluescreen... [More]