Home / malware

PDF

JS.Trojan.Coolsites.A

First posted on 21 November 2011.
Source: BitDefender

Aliases :

JS.Trojan.Coolsites.A is also known as JS/Coolsites.A@mm.

Explanation :

It writes in the registry, in the key:
HKEY_CURRENT_USERSoftwareMicrosoftInternet ExplorerMainStart Page
the value: http:/ /balder.prohosting.com/~mic124/sex.htm in order to load that web page when starting Internet Explorer.

For all the contacts from address book, it sends mail, with the subject:
Hi!!
and the body
Hi. I found cool site! http://celebxx.cjb.net It's really cool!.

Last update 21 November 2011

 

TOP