The story of these new versions of winols(since 2.24) started with a guy who claimed to break obsidium protection. I'm really curious where this magical vm comes from. I've got a WinOLS 4.28 vm and it looks like it is the same vm, but with a older winols version (and without trojans). Also delete the network adapter from the vm because, why should it need internet access?Įdit: one more trojan: at C:\Users\deviance\Documents\HDSDR theres is a hidden "Client-build.exe" executable. Delete the scheduler job and the executable, then the vm should be safe to use. I've targeted it down to this executable and this is it:
I saw it because something started all the time batches and ping localhost at the background. It looks like there is a quasar rat trojan in the vm at C:\windows\system32\network\svchost.exe
0 kommentar(er)
