Madoka.exe: Difference between revisions
No edit summary |
mNo edit summary |
||
| Line 20: | Line 20: | ||
If the malware is launched from the system directory with ''ozawa.exe'' as the name (either from auto start or double click manually in system directory), it will enter "reside mode" without showing the initial payload with the normal woman picture. Instead, it runs in background. It will then show the screamer image along with the scream sound effect indefinitely in the following interval: 3 minutes, 10 minutes, 30 minutes, 60 minutes, 60 minutes, 60 minutes ... | If the malware is launched from the system directory with ''ozawa.exe'' as the name (either from auto start or double click manually in system directory), it will enter "reside mode" without showing the initial payload with the normal woman picture. Instead, it runs in background. It will then show the screamer image along with the scream sound effect indefinitely in the following interval: 3 minutes, 10 minutes, 30 minutes, 60 minutes, 60 minutes, 60 minutes ... | ||
If the user executes the original EXE once again after infection, the normal woman picture and | If the user executes the original EXE once again after infection, the normal woman picture and the "meet-again dialogue" text will be shown and there is no screamer picture. | ||
The program also records the number of executions of the original EXE (not the one in system directory) in ''win.ini''. If it is run over 5 times, the malware will show the "bye dialogue" with the normal woman picture, then uninstall itself. | The program also records the number of executions of the original EXE (not the one in system directory) in ''win.ini''. If it is run over 5 times, the malware will show the "bye dialogue" with the normal woman picture, then uninstall itself. | ||
| Line 84: | Line 84: | ||
*web.archive.org/web/20041106190224/geocities.co.jp/SiliconValley-Oakland/8358/mysoft/files/madoka08.zip | *web.archive.org/web/20041106190224/geocities.co.jp/SiliconValley-Oakland/8358/mysoft/files/madoka08.zip | ||
*files.screamer.wiki/other/madoka08.zip | *files.screamer.wiki/other/madoka08.zip | ||
<br> | *web.archive.org/web/20040806024306/<nowiki>http://www.geocities.co.jp:80/SiliconValley-Oakland/8358/mysoft/mysoft.html</nowiki> '''(Author's homepage with descriptions of several other software including Madoka and Hikaru)'''<br> | ||
{{Maliciousnav}} | {{Maliciousnav}} | ||
[[Category:Applications]] | [[Category:Applications]] | ||
