A new virus called Qbot, also known as Qakbot, has appeared on the Internet, infecting computers only under
Due to the fact that Microsoft stopped updating Windows 7, the system became vulnerable. One of the viruses to attack an outdated OS, due to its popularity, is just Qbot.
The Trojan is “delivered” via email, inemails with an attached HTML file that downloads a ZIP archive with a password. After unzipping, the user finds an ISO image with the calc.exe file, which replaces the real Calendar program built into Windows 7, as well as two libraries with DLLs - WindowsCodecs.dll and 7533.dll.
In addition to these files, there is a shortcut inside the image withextensions "lnk.", which pretends to be a PDF file with important information, or a file that opens in the Microsoft Edge browser. But when this file is opened, the computer is infected.
This happens by loading the calc.exe file with the WindowsCodecs.dll library - with the same name as the original one, as a result of which the fake library replaces the system one.
As noted, there is no such vulnerability on newer generations of Windows.