Autoit Survey Winlocker

I found this while looking at the files that the barracuda http bots were downloading.

First screen
CPA gateway
The only survey leads to a parked domain, my computer is locked forever
The winlocker is coded in autoit, so I decompiled it to an autoit script here: http://pastebin.com/ayK5QsVD
The important parts are the three html files dropped to the disk. I have uploaded them in a paste here: http://pastebin.com/k0a0cPsB
The survey gateway info is here: 
http://www.cpalead.com/overlay_gateway.php?pub=131725&gateid=NDgwOTQ0

Sample is here

You can find a tutorial on decompiling to autoscript here.

Categories: Uncategorized