Beware of .scr files

[Quovadis]

A few weeks ago, some random people started sharing "Screenshot" links on steam and such.

 

This is an example of a link: http://****.com/IMG_02112014.png.

The link doesn't download a png file but a .scr file.

It even has an icon that makes it look like windows generated a preview of the image.

 

Renaming it to a .exe file and using JetBrains's dotPeek to uncompile it shows some basic .NET C# code written in chinese.

 

Nice try kido.

 

using System;

using System.Threading;

using System.Windows.Forms;

using 艾娜贼艾伊艾哦克;



namespace 丝马诶艾马艾豆比

{

  internal static class 艾伊艾伊西艾娜吉

  {

    private static void 贼艾吉维豆艾丝艾(string[] args)

    {

      Thread.Sleep(10);

      Application.EnableVisualStyles();

      Application.SetCompatibleTextRenderingDefault(false);

      Application.Run((Form) new 德勒吾开维艾克维(args));

    }



    [STAThread]

    public static void 艾艾斯艾儿尔丝吾(string[] args)

    {

      try

      {

        if (args[0] == "/S")

          德勒吾开维艾克维.豆娜贝娜娜 = true;

        艾伊艾伊西艾娜吉.贼艾吉维豆艾丝艾(args);

      }

      catch (Exception ex)

      {

        艾伊艾伊西艾娜吉.贼艾吉维豆艾丝艾(args);

      }

    }

  }

}

Edited January 2, 2015 by Heretic121
Link removed.

[SinfulRaevyn]

Mhmmm. I clicked the link on purpose to see what would happen... lol trojan with keylogger. -.- Easily removed with superantispyware and malwarebytes.

[Heretic121]

This is an example of a link: [Link removed](do not click it).

 

Removed the link because people have a nasty habit of being idiots

[Quovadis]

Removed the link because people have a nasty habit of being idiots

 

I readded and censored the link since the pattern of the URL is relevant to the topic.

[Papito]

I readded and censored the link since the pattern of the URL is relevant to the topic.

 

lol, you should remove that link or at least change something on it, cuz you're sharing the virus.

 

Maybe like this

http://****.com/IMG_02112014.png

IMHO

Edited January 2, 2015 by Heretic121
Edited your proposed edit of my edit of his original post...

[Heretic121]

I edited your edit and removed the actual link from it

[Quovadis]

lol, you should remove that link or at least change something on it, cuz you're sharing the virus.

 

Maybe like this

http://****.com/IMG_02112014.png

IMHO

 

It's a topic in security section I honestly don't expect people to be dumb enough to click the link, download the file and execute when the whole topic is a warning of it's content lmao.

Anyway I already censored the link.

[Platonic]

I honestly don't expect people to be dumb enough

Optimism, bah

[Ol Smoke]

I will click on anything, especially if there is a coupon attached.

[VanDuyvesteijn]

I will click on anything, especially if there is a coupon attached.

 

Me too sadly I would never want to risk some hot girls in my area that want to meet me be not able to contact me!

 

Still Quovadis thanks for sharing this with us because I learned a new thing that might actually help me in the future

[Papito]

It's a topic in security section I honestly don't expect people to be dumb enough to click the link, download the file and execute when the whole topic is a warning of it's content lmao.

Anyway I already censored the link.

 

Indeed when you said it was an example I was waiting an image for what you get, not the link of the malware.