Qc commented on a mIRC Bot, QBot v0.6  -  Jan 28, 2007

It\'s UPX packed, rather uncommon for legit software and instead very common for malicious software. I unpacked it, viewed it in hexeditor
and it has registry change key functions, install screensaver function, TerminateProcess ExitWindowsEx SetFileAttributes functions etc.

I wonder why this is called a \'script\'. I don\'t think I\'ll run it to see more.

Was this file replaced or so, after reviewing?

 Respond  
Are you sure you want to unfollow this person?
Are you sure you want to delete this?
Click "Unsubscribe" to stop receiving notices pertaining to this post.
Click "Subscribe" to resume notices pertaining to this post.