Slashdot Mirror

Read the report: http://ip.securescience.net/advisories/Glamour-Ran somWare.pdf page 15.
There is in fact a check for a value of "31337" in a "WinCode" registry key.

There's no link to the advisories page from their front page, the advisories page doesn't actually list the .pdf, and the home page isn't the same as the first page.

There's no link to the advisories page from their front page, the advisories page doesn't actually list the .pdf, and the home page isn't the same as the first page.

You want details? This trojan appears to be a variant of this nasty little bugger. (Warning: pdf). The link is to a detailed technical report on how it works, what it does, and how to decrypt data it encrypted. It was authored by Secure Science Corporation back in November of 2006.

Source