Mozilla and Orkut-hating virus!
This time, we have a virus which hates Orkut and Mozilla Firefox! Mozban virus does not allow PC user to Firefox browser and to open Orkut website. This virus makes use of AutoHotKey to do this and also to replicate itself. Mozban spreads through secondary storage devices like USB drives, CDs etc.
Here are the screen shots of message boxes displayed by the virus when Orkut website is opened or Firefox is launched:
Svchost.exeis nothing but renamed AutoHotKey program! Mozban creates a folder named
heap41ain the root drive, and files listed below:
And, the folder offspring contains:
reproduce.txtcontain AutoHotKey scripts, which are executed by
Here are the screen shots Jotti Malware Scan results of files - svchost.exe and MicrosoftPowerPoint.exe - dropped by the virus: