Eric.freyssinet: Text replacement - " août " to " aug"

2015-08-05T19:31:04Z

Text replacement - " août " to " aug"

← Older revision		Revision as of 19:31, 5 August 2015
Line 8:		Line 8:
	\|Author=David Harley,		\|Author=David Harley,
	\|NomRevue=ESET Threat Blog		\|NomRevue=ESET Threat Blog
	\|Date=13 ~~août 2012~~		\|Date=13 aug2012
	\|Editor=ESET		\|Editor=ESET
	\|Year=2012		\|Year=2012

Eric.freyssinet: 1 revision imported

2015-02-07T14:27:26Z

1 revision imported

← Older revision		Revision as of 14:27, 7 February 2015
(No difference)

Eric.freyssinet at 12:53, 16 August 2012

2012-08-16T12:53:41Z

New page

{{Publication
|Image=
|Legend=
|Document=
|Licence=
|Video=
|Link=http://blog.eset.com/2012/08/11/dorifelquervar-the-support-scammers-secret-weapon blog.eset.com
|Author=David Harley,
|NomRevue=ESET Threat Blog
|Date=13 août 2012
|Editor=ESET
|Year=2012
|ISBN=
|Page=
|Abstract=The malware that some people are calling Dorifel or XDocCrypt (ESET detects it as Win32/Quervar.C and has a cleaner for it here) is having enormous impact right now, mostly in the Netherlands. It has some very interesting characteristics – it infects documents (and true executables) by appending them RC4-encrypted to the body of a new executable – and there’ll be a technical analysis by Róbert Lipovský here shortly.

However, apart from its intrinsic technical interest, it seems that it’s being used for scamming purposes that even its authors may not have anticipated. Martijn Grooten, of Virus Bulletin, tells me that it has attracted the attention of telephone support scammers, who are using it to convince potential victims in the Netherlands that they need to let the scammer ‘clean’ or ‘protect’ their systems. For a price, as always…
|Botnet=Dorifel, XDocCrypt, Quervar,
|Malware=,
|CCProtocol=,
|Operation=,
|Keyword=,
}}

Dorifel/Quervar: the support scammer’s secret weapon - Revision history

Eric.freyssinet: Text replacement - " août " to " aug"

Eric.freyssinet: 1 revision imported

Eric.freyssinet at 12:53, 16 August 2012