Your Ad Here

We have moved to

ATX If you are this blogs reader, I encourage you to visit and join ATX. This blog will not be discontinued but all the recent updates will be on ATX. ATX brings you a more exciting look, more premium software for free and ofcourse a chance to win invitations of some selected sites.


Resource site of Computer software, Phone application, E-books, Programming codes, yahoo tools, tutorials, hacking tools, keylogger, trojan, hacking, MP3 and much more. ::CORE™::

Tuesday, September 29, 2009

Redolf Virus Source COde

WARNING: The Virus Source Code is for information purposes only, for researchers and computer virus or programming enthusiasts. No warranty is given or to be implied for any software listings contained herein. You take full responsibility for any damages caused by compiling, running, or sharing this information. Be aware that running any malicious code on another's computer or computer network might be a criminal act. Use at your own risk!

Redlof is polymorphic virus that embeds itself without any attachment to every e-mail sent from the infected system. It executes when an infected email message is viewed.

NAME: Redlof
ALIAS: VBS.Redlof, VBS/Redlof


VBS/Redlof.A@m executes directly from an infected message by using a security vulnerbility in Internet Exlorer known as Microsoft VM ActiveX Control Vulnerability. More information about the vulnerability and a fix is available from Microsoft:

When the virus executes, it infects a file "web\Folders.htt" at the Windows installation directory which causes that the virus activates when any directory is opened using the Active Desktop's web folder feature.

The virus also infects files with extensions "htm", "html", "asp", "php", "jsp", "htt" or "vbs".

Redlof drops the following infected files:

\Program Files\Common Files\Microsoft Shared\Stationery\blank.html

"blank.html" is used to replace the default stationaries for both Outlook and Outlook Express via registry causing that the every message sent from an infected system will carry the virus.

The "Kernel32.dll" is also set to registry so that it will be executed on the system restart:




Post a Comment | Feed

Post a Comment

Related Posts with Thumbnails


Widget by Blog Godown


Center of Reverse Engineering™ Copyright © 2009 Premium Blogger Dashboard Designed by SAER

ss_blog_claim=982832c1e8ace00c1392e8b9a7a4bbfd ss_blog_claim=982832c1e8ace00c1392e8b9a7a4bbfd