![]() The SCRIPT.INI file contains the comments: That send a worm copy (the file) to all users In case at least one of these files is found in a subdirectory, the wormĭrops a new SCRIPT.INI file to there. Please dont edit this script… mIRC will corrupt, if mIRC willĬorrupt… WINDOWS will affect and will not run correctly. ![]() ![]() When an IRC user receieves that infected HTML, it is copied to an IRC download directory. The worm then is activated from that file only in case the user clicks it on. It drops its VBS code to the Windows system directory with the MSKERNE元2.VBS name and registers it in the Windows auto-run section in system registry: In case the user really clicks ‘YES’ the worm gets access to disk files and – Please press ‘YES’ button to Enable ActiveX First, it displays a message to fool the user: Because the browser’s security settings don’t allow scripts to access disk files and display a warning message, the worm uses a trick to avoid that. ![]() In case ‘NO’ is chosen, the worm intercepts the mouse movement and keypress events and #I love you virus download code
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |