Suspicious activity stopped, code Yellow/Blackwatch Plaid

vb_master · Post by **vb_master** » Tue Aug 30, 2005 7:39 am

A.J. Franzman wrote:JS/Exploit-MhtRedir.gen

I got JS/Exploit-MhtRedir.ldr, so figure that out?!

madc0w · Post by **madc0w** » Tue Aug 30, 2005 7:39 am

seems to be gone for me.

jtaylor0913 · Post by **jtaylor0913** » Tue Aug 30, 2005 10:15 am

it is gone for me too.

A.J. Franzman · Post by **A.J. Franzman** » Tue Aug 30, 2005 3:13 pm

vb_master wrote:
A.J. Franzman wrote:JS/Exploit-MhtRedir.gen
I got JS/Exploit-MhtRedir.ldr, so figure that out?!

Different antivirus software vendors use different naming conventions, so there are often multiple names for the same malware, but they are often similar enough to recognize. However, in this case it may really be 2 different variants since in my mind a ".gen" (generator) should be different than a ".ldr" (loader). I think a generator would be code that creates a file locally, while a loader would be code that fetches a file from a remote source. But in either case, they are obviously referring to the same end-result file.